tan-cli 0.7.0__py3-none-any.whl

tan/planner/kconfig.py

@@ -0,0 +1,2435 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""Per-slice Kconfig (alp.conf) emitter.
+
+`_slice_alp_conf` renders a Zephyr slice's Kconfig fragment off the parsed model
++ the resolved capabilities / chip-driver / library / peripheral enables;
+`_emit_extra_library_profile` renders an extra `libraries:` profile fragment.
+Extracted as the #285 kconfig emit seam. The slug / peripheral-Kconfig /
+chip-subsystem tables come from the slugs.py leaf and the per-library
+HW-accelerator matcher from the libraries.py layer -- both plain module-scope
+imports now. In alp-sdk they were lazy in-body imports of `alp_project` /
+`alp_project_emit` (a cycle-break there, since `alp_project` imported this
+module), and after the relocation they were the last thing making an emit from
+`tan` load alp-sdk's Python at all. Per-core `libraries:` Kconfig is read from
+each library's manifest via `_per_core_library_kconfig`.
+
+`_slice_alp_conf` itself is a thin composer over a set of `_emit_*` section
+helpers (console / SoM capability / chip driver / subsystem / library /
+inference / cross-core shmem cache / memory / power / storage / OTA /
+diagnostics), each returning that section's `list[str]` fragment. Split out
+mechanically as the #673 Phase-1 kconfig split -- behavior-preserving,
+byte-identical emit output; see `check_emit_snapshots.py`.
+
+This module is a pure string templater: it never runs kconfiglib/west, so
+every emitted `CONFIG_*` line must be provable correct from this module's own
+YAML/JSON inputs + its own `zephyr/kconfigs/*.kconfig` tree -- it cannot ask
+the real Kconfig solver whether a symbol's dependency chain resolves.
+Consequently the emitted alp.conf's Kconfig symbol set is coupled to the
+alp-sdk module version that generated it, the same way `west.yml` deliberately
+pins one Zephyr/module release at a time (docs/zephyr-version-policy.md); an
+alp.conf generated by one alp-sdk version is not a promised-compatible input
+to a Zephyr tree built against another. Detecting that cross-version skew
+cleanly (rather than a Kconfig "assign to undefined symbol" abort) is #855's
+job, not this module's -- this module only owns intra-version dependency
+gating (see #874).
+"""
+
+from __future__ import annotations
+
+import re
+from functools import lru_cache
+from pathlib import Path
+from typing import Any, Optional
+
+import yaml
+
+from . import cameras as _cameras
+from . import libraries as _library_layer
+from . import sdk_compat as _sdk_compat
+from .link_target import applies_to as link_applies_to
+from .loader import _library_alias_table
+from .models import BoardProject, OrchestratorError, Slice
+from .ownership import project_m33_overlay
+from .paths import REPO
+from .partition import resolve_storage_partitions
+from .slugs import (
+    _BLOCK_SLUGS,
+    _CHIP_SUBSYSTEMS,
+    _board_define_slug,
+    _is_tbd,
+    _slugs_from_helper_firmware,
+    _slugs_from_on_module,
+    _som_define_slug,
+    peripheral_kconfig,
+)
+from .som_metadata import (
+    resolve_capabilities,
+    silicon_to_kconfig,
+    som_unpopulated_capabilities,
+)
+
+
+def _emit_extra_library_profile(
+    name: str,
+    profile_rel: str,
+    project: "BoardProject",
+) -> list[str]:
+    """Walk an extra_libraries `profile:` file and emit the per-class
+    first-match Kconfig lines for the active SoM.
+
+    Mirrors the curated-library `integration.zephyr.hw_backends` matcher
+    (folded into each `metadata/libraries/<lib>.yaml` manifest): each
+    accelerator class declares a `priority:` list whose entries carry
+    `silicon:` / `soc_family:` / `requires_cap:` matchers plus a
+    `kconfig:` directive.  Entries marked `status: planned` or
+    `status: stub` are metadata only and are not emitted as active
+    build claims.  First matching implemented entry per class wins; an
+    `sw_fallback:` block with `kconfig:` is always emitted at the end
+    so the build has a SW floor when no HW backend matches.
+
+    Returns the list of emitted lines (each line is a complete
+    `CONFIG_*=y` or `# ...` comment); empty list when the profile
+    parses but nothing matches and there's no sw_fallback.
+
+    Failures (malformed YAML, missing keys) emit a single `#`-prefixed
+    diagnostic comment so the customer sees the failure in the slice's
+    alp.conf rather than silent drop-out.
+    """
+    # No longer a divergence: alp-sdk#1961 landed as alp-sdk PR #2005 and
+    # this repo's #1241 re-sync (to alp-sdk 15b2f32c) converged the two
+    # copies, so the RELOCATED marker that stood here is retired with
+    # tan-cli#1122. Upstream now spells these three lines identically --
+    # `.resolve()` dropped (nothing downstream needs a real path, only the
+    # read does) and `UnicodeDecodeError` in the clause, because it is a
+    # `ValueError` not an `OSError` and `read_text(encoding="utf-8")` would
+    # otherwise escape a function contracted never to raise.
+    try:
+        profile_path = REPO / profile_rel
+        doc = yaml.safe_load(profile_path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, yaml.YAMLError) as e:
+        return [f"# extra_libraries[{name}] profile parse failed: {e}"]
+    if not isinstance(doc, dict):
+        return [f"# extra_libraries[{name}] profile is not a mapping"]
+
+    # Match keys come from the active SoM.  Mirror
+    # libraries._SOC_FAMILY_TOKEN so extra_libraries entries can
+    # share existing curated-profile match keys when desired.
+    silicon_ref = project.som_preset.get("silicon") or ""
+    family = (project.som_preset.get("family") or "").lower()
+    soc_family_token: Optional[str] = None
+    if family.startswith("alif-ensemble"):
+        soc_family_token = "alif_ensemble"
+    elif family.startswith("renesas-rzv2n"):
+        soc_family_token = "renesas_rzv2n"
+
+    # resolve_capabilities merges SoC-JSON defaults + SoM overrides.
+    capabilities = resolve_capabilities(project.som_preset, project.effective_metadata_root())
+
+    def _cap_truthy(cap_name: str) -> bool:
+        v = capabilities.get(cap_name)
+        if v is None:
+            return False
+        if isinstance(v, bool):
+            return v
+        if isinstance(v, int):
+            return v > 0
+        s = str(v).lower()
+        if s in ("true", "yes"):
+            return True
+        if s in ("false", "no", "null", "none", "0", ""):
+            return False
+        try:
+            return int(s) > 0
+        except ValueError:
+            return False
+
+    def _entry_matches(e: dict[str, Any]) -> bool:
+        status = str(e.get("status", "implemented")).strip().lower()
+        if status in {"planned", "stub"}:
+            return False
+        sili = e.get("silicon")
+        sf = e.get("soc_family")
+        cap = e.get("requires_cap")
+        if sili is not None and sili != silicon_ref:
+            return False
+        if sf is not None and sf != soc_family_token:
+            return False
+        if cap is not None and not _cap_truthy(str(cap)):
+            return False
+        return True
+
+    out: list[str] = []
+    accelerators = doc.get("accelerators") or []
+    if isinstance(accelerators, list):
+        for cls in accelerators:
+            if not isinstance(cls, dict):
+                continue
+            cls_name = cls.get("class") or "<unknown>"
+            for p in (cls.get("priority") or []):
+                if not isinstance(p, dict):
+                    continue
+                if not _entry_matches(p):
+                    continue
+                kc = p.get("kconfig")
+                if isinstance(kc, str) and kc:
+                    out.append(f"{kc}  # {name} / {cls_name}")
+                break
+
+    sw = doc.get("sw_fallback")
+    if isinstance(sw, dict):
+        kc = sw.get("kconfig")
+        if isinstance(kc, str) and kc:
+            out.append(f"{kc}  # {name} / sw_fallback")
+
+    return out
+
+
+# --------------------------------------------------------------------
+# Console backend auto-selection (issue: generic console).
+#
+# The Alp SDK is a generic, multi-OS SoM layer: the same example can be
+# built for a Zephyr core (Cortex-M) or a Linux core (Cortex-A / Yocto),
+# and the console backend that "printf lands on" differs per OS.  Rather
+# than force every app author to hand-pick console Kconfig (the old AEN
+# bench examples hard-coded a RAM console, which then fought the board's
+# real UART console), the generator selects it automatically from the
+# slice's `os:` and lets the SoM manufacturer / customer override via a
+# single `diagnostics.console:` knob in board.yaml.
+#
+#   auto  (default) -> os: zephyr        => alp  (UART console)
+#                      os: yocto/ubuntu  => linux (stdio/tty console)
+#                      other             => none
+#   alp | uart      -> Zephyr UART console (the module's console UART,
+#                       e.g. E1M edge UART0; the board layer owns the
+#                       `zephyr,console` DT chosen + pinmux).
+#   ram             -> Zephyr RAM console (bench flow: read the buffer
+#                       over SWD when no serial line is available).
+#   linux           -> Linux console (nothing to emit on the Zephyr side;
+#                       meaningful only on a yocto slice).
+#   none | off      -> emit nothing; inherit whatever the board provides.
+# --------------------------------------------------------------------
+_CONSOLE_ALIASES = {
+    "alp": "uart",
+    "uart": "uart",
+    "serial": "uart",
+    "ram": "ram",
+    "swd": "ram",
+    "linux": "linux",
+    "stdio": "linux",
+    "none": "none",
+    "off": "none",
+}
+
+
+def _resolve_console(value: Optional[str], os_: str,
+                     hw_console: bool = True) -> str:
+    """Resolve the effective console backend for a slice.
+
+    ``value`` is the raw ``diagnostics.console:`` knob (or ``None`` /
+    ``"auto"`` for the OS-derived default); ``os_`` is the slice OS.
+    ``hw_console`` is the SoM-topology fact (``topology.<id>.hw_console``):
+    a headless core (``False``) has no hardware UART console, so the
+    AUTO-resolved Zephyr default must be ``"none"`` (inherit the board
+    default) instead of ``"uart"`` -- emitting ``CONFIG_UART_CONSOLE=y``
+    on a core whose board has no serial driver is an "assigned y but got n"
+    Kconfig error, fatal to the Zephyr build (issue #717).  An explicit
+    ``diagnostics.console:`` still wins for a headless core (the caller may
+    upgrade a headless AUTO to ``"ram"`` via ``diagnostics.sim_console``,
+    #686).  Returns one of ``"uart"``, ``"ram"``, ``"linux"``, ``"none"``.
+    """
+    v = (value or "auto").strip().lower()
+    if v == "auto":
+        if os_ == "zephyr":
+            return "uart" if hw_console else "none"
+        if os_ in ("yocto", "ubuntu"):
+            return "linux"
+        return "none"
+    return _CONSOLE_ALIASES.get(v, "none")
+
+
+#: Floor for `CONFIG_RAM_CONSOLE_BUFFER_SIZE` when `diagnostics.console: ram`
+#: selects the RAM console.  An app that sets a larger size in its own
+#: `prj.conf` keeps it (see `_app_ram_console_size`).  Only `prj.conf` is
+#: read: a size set in `boards/<board>.conf`, `prj_<board>.conf` or an app
+#: `EXTRA_CONF_FILE` is not seen and still loses to this floor.
+_RAM_CONSOLE_MIN_SIZE = 2048
+
+_RAM_CONSOLE_SIZE_RE = re.compile(
+    r"^\s*CONFIG_RAM_CONSOLE_BUFFER_SIZE\s*=\s*(0[xX][0-9a-fA-F]+|\d+)\s*(?:#.*)?$")
+
+
+def _app_ram_console_size(project: BoardProject, slice_: Slice) -> int:
+    """`CONFIG_RAM_CONSOLE_BUFFER_SIZE` the slice's own `prj.conf` sets, or 0.
+
+    The generated alp.conf is merged AFTER prj.conf, so a bare assignment
+    would clobber (and shrink) an app-set size -- the app's console then
+    wraps (tan-cli#1401).  Best effort: no source dir, no app, or an
+    unreadable prj.conf all read as "app sets nothing".  Limit: only
+    `prj.conf` is read, so sizes set in `boards/<board>.conf`,
+    `prj_<board>.conf` or an app `EXTRA_CONF_FILE` still lose.
+    """
+    if project.source_dir is None or not slice_.app:
+        return 0
+    from .orchestrator import _zephyr_app_dir  # lazy: orchestrator imports us
+    try:
+        prj = _zephyr_app_dir(slice_.app, project.source_dir) / "prj.conf"
+        text = prj.read_text(encoding="utf-8")
+    except (OSError, OrchestratorError, UnicodeDecodeError):
+        return 0
+    size = 0
+    for line in text.splitlines():
+        m = _RAM_CONSOLE_SIZE_RE.match(line)
+        if m:
+            # Last assignment wins, like Kconfig.  Kconfig reads an int symbol
+            # as hex with a 0x prefix, else base 10 -- `016384` is 16384,
+            # where int(x, 0) would raise ValueError.
+            tok = m.group(1)
+            size = int(tok, 16) if tok[:2] in ("0x", "0X") else int(tok, 10)
+    return size
+
+
+def _emit_zephyr_console(console: str, sim_console: bool = False,
+                         ram_size: int = _RAM_CONSOLE_MIN_SIZE) -> list[str]:
+    """Kconfig lines for a Zephyr slice's resolved console backend.
+
+    ``sim_console`` distinguishes a RAM console selected explicitly via
+    ``diagnostics.console: ram`` (bench SWD flow) from one auto-selected
+    for a headless core by ``diagnostics.sim_console: true`` (studio sim
+    streams the ring over ``uart_socket``); the emitted Kconfig is
+    identical, only the teaching comment differs.
+    """
+    if console == "uart":
+        return [
+            "# Console: Alp UART console (auto-selected for os: zephyr).",
+            "# printf/LOG land on the module's console UART (the board layer",
+            "# owns the `zephyr,console` DT chosen + pinmux -- e.g. E1M edge",
+            "# UART0).  Override in board.yaml with `diagnostics.console: ram`",
+            "# (SWD bench flow) or `none` (inherit the board default).",
+            "CONFIG_SERIAL=y",
+            "CONFIG_CONSOLE=y",
+            "CONFIG_UART_CONSOLE=y",
+            "CONFIG_UART_INTERRUPT_DRIVEN=y",
+            "",
+        ]
+    if console == "ram":
+        header = (
+            [
+                "# Console: RAM console (board.yaml `diagnostics.sim_console: "
+                "true`).",
+                "# This core has no hardware UART console -- the studio",
+                "# simulator streams `ram_console_buf` over its `uart_socket`.",
+            ]
+            if sim_console
+            else [
+                "# Console: RAM console (board.yaml `diagnostics.console: "
+                "ram`).",
+                "# No serial line on this bench -- read `ram_console_buf` "
+                "over SWD.",
+            ]
+        )
+        return header + [
+            "# LOG is routed to printk so the RAM backend still captures it.",
+            "CONFIG_CONSOLE=y",
+            "CONFIG_RAM_CONSOLE=y",
+            f"CONFIG_RAM_CONSOLE_BUFFER_SIZE={ram_size}",
+            "CONFIG_UART_CONSOLE=n",
+            "",
+        ]
+    # "linux" on a Zephyr slice is meaningless, and "none" means inherit
+    # the board default -- emit nothing in both cases.
+    return []
+
+
+_LINUX_WIRELESS_PROVIDER_PREFIXES = ("murata_", "cyw")
+
+
+def _wireless_provider(project: BoardProject) -> Optional[str]:
+    """Return the SoM's on-module Wi-Fi/BLE provider slug, if known."""
+    om = project.som_preset.get("on_module") or {}
+    provider = om.get("wifi_ble")
+    if not isinstance(provider, str):
+        return None
+    provider = provider.strip()
+    # Case-insensitive: "tbd"/"Tbd" are the same hand-typed placeholder as
+    # a bare "TBD" (alp-sdk #1048); `provider` is already whitespace-
+    # stripped above.
+    if not provider or provider.upper() == "TBD":
+        return None
+    return provider
+
+
+def _is_linux_wireless_provider(provider: Optional[str]) -> bool:
+    """True when Wi-Fi/BLE data paths are owned by the Linux BSP stack."""
+    if provider is None:
+        return False
+    return provider.startswith(_LINUX_WIRELESS_PROVIDER_PREFIXES)
+
+
+def _zephyr_iot_kconfig(
+    project: BoardProject,
+    slice_: Slice,
+    resolved_chip_state: dict[str, bool],
+) -> list[str]:
+    """Kconfig lines for ``cores.<id>.iot`` on a Zephyr slice.
+
+    ``resolved_chip_state`` is the same som -> board-populated -> project-chips
+    resolved on/off map ``_emit_chips`` prints from (see
+    ``_resolve_chip_states``) -- the CC3501E bridge backend
+    (``ALP_SDK_WIFI_CC3501E`` / ``ALP_SDK_BLE_CC3501E``) ``depends on
+    ALP_SDK_CHIP_CC3501E``, so a board variant that turns the chip off via
+    ``populated: { cc3501e: false }`` must not also get a Wi-Fi/BLE
+    ``=y`` line that silently resolves to n (issue #874).
+    """
+    iot = slice_.iot or {}
+    if not any(iot.get(k) for k in ("wifi", "mqtt", "tls", "ble")):
+        return []
+
+    provider = _wireless_provider(project)
+    lines: list[str] = [
+        f"# IoT features declared on core `{slice_.core_id}` "
+        "(board.yaml `cores.*.iot`)",
+    ]
+    if provider:
+        lines.append(
+            f"# Wireless provider resolved from `{project.sku}` "
+            f"on_module.wifi_ble: {provider}.")
+    else:
+        lines.append("# Wireless provider is TBD/absent; using generic Zephyr stack gates.")
+
+    emitted: set[str] = set()
+
+    def add(line: str) -> None:
+        if line.startswith("CONFIG_"):
+            if line in emitted:
+                return
+            emitted.add(line)
+        lines.append(line)
+
+    def add_network_base() -> None:
+        add("CONFIG_NETWORKING=y")
+        add("CONFIG_NET_IPV4=y")
+        add("CONFIG_NET_SOCKETS=y")
+
+    linux_owned = _is_linux_wireless_provider(provider)
+
+    if iot.get("wifi"):
+        if provider == "cc3501e":
+            if resolved_chip_state.get("cc3501e"):
+                add("# Wi-Fi: AEN CC3501E bridge backend, not Zephyr wifi_mgmt.")
+                add("CONFIG_ALP_SDK_WIFI_CC3501E=y")
+            else:
+                add("# Wi-Fi: SoM wireless provider is CC3501E, but this board")
+                add("# does not populate the chip (board.yaml `populated.cc3501e: "
+                    "false`);")
+                add("# no Wi-Fi backend is emitted for this slice.")
+        elif linux_owned:
+            add("# Wi-Fi: provider data path is Linux/BSP-owned on this SoM;")
+            add("# no Zephyr wifi_mgmt backend is emitted for this slice.")
+        else:
+            add("# Wi-Fi: generic Zephyr wifi_mgmt station path.")
+            add_network_base()
+            add("CONFIG_WIFI=y")
+            add("CONFIG_NET_MGMT=y")
+            add("CONFIG_NET_MGMT_EVENT=y")
+            add("CONFIG_NET_L2_WIFI_MGMT=y")
+            add("CONFIG_ALP_SDK_IOT_WIFI=y")
+
+    if iot.get("mqtt"):
+        add("# MQTT: Zephyr mqtt_client over the active socket provider.")
+        add_network_base()
+        add("CONFIG_NET_TCP=y")
+        add("CONFIG_MQTT_LIB=y")
+        add("CONFIG_ALP_SDK_IOT_MQTT=y")
+
+    if iot.get("tls"):
+        add("# TLS: credential store + TLS-capable protocol clients.")
+        # TLS_CREDENTIALS needs the networking base even when neither
+        # `wifi:` nor `mqtt:` is also set on this slice -- omitting it left
+        # CONFIG_TLS_CREDENTIALS=y silently resolving to n (unmet
+        # NETWORKING/NET_SOCKETS deps), issue #874.  add_network_base()
+        # dedupes against the wifi/mqtt branches above.
+        add_network_base()
+        add("CONFIG_TLS_CREDENTIALS=y")
+        if iot.get("mqtt"):
+            add("CONFIG_MQTT_LIB_TLS=y")
+
+    if iot.get("ble"):
+        if provider == "cc3501e":
+            if resolved_chip_state.get("cc3501e"):
+                add("# BLE: AEN CC3501E bridge backend, not Zephyr HCI.")
+                add("CONFIG_ALP_SDK_BLE_CC3501E=y")
+            else:
+                add("# BLE: SoM wireless provider is CC3501E, but this board")
+                add("# does not populate the chip (board.yaml `populated.cc3501e: "
+                    "false`);")
+                add("# no BLE backend is emitted for this slice.")
+        elif linux_owned:
+            add("# BLE: provider data path is Linux/BSP-owned on this SoM;")
+            add("# no Zephyr BT-host backend is emitted for this slice.")
+        else:
+            add("# BLE: generic Zephyr BT host path.")
+            add("CONFIG_BT=y")
+            add("CONFIG_BT_PERIPHERAL=y")
+            add("CONFIG_BT_CENTRAL=y")
+            add("CONFIG_ALP_SDK_BLE=y")
+
+    lines.append("")
+    return lines
+
+
+def _yocto_iot_lines(project: BoardProject, slice_: Slice) -> list[str]:
+    """local.conf lines for ``cores.<id>.iot`` on a Yocto slice."""
+    iot = slice_.iot or {}
+    if not any(iot.get(k) for k in ("wifi", "mqtt", "tls", "ble")):
+        return []
+
+    provider = _wireless_provider(project)
+    lines: list[str] = [
+        "",
+        f"# IoT features declared on core `{slice_.core_id}` "
+        "(board.yaml `cores.*.iot`)",
+    ]
+    if provider:
+        lines.append(
+            f"# Wireless provider resolved from `{project.sku}` "
+            f"on_module.wifi_ble: {provider}.")
+    else:
+        lines.append("# Wireless provider is TBD/absent; emit generic Linux userland.")
+
+    image_pkgs: list[str] = []
+    packageconfig: list[str] = []
+
+    def add_unique(seq: list[str], value: str) -> None:
+        if value not in seq:
+            seq.append(value)
+
+    linux_owned = _is_linux_wireless_provider(provider)
+
+    if iot.get("wifi"):
+        if provider == "cc3501e":
+            lines.append("# Wi-Fi: CC3501E is controlled by the Zephyr/companion path.")
+        else:
+            if linux_owned:
+                lines.append(
+                    "# Wi-Fi: Linux owns this provider's SDIO/firmware path; "
+                    "BSP/machine recipes supply kernel/firmware packages.")
+            add_unique(image_pkgs, "wpa-supplicant")
+            add_unique(image_pkgs, "iw")
+            add_unique(image_pkgs, "wireless-regdb")
+
+    if iot.get("ble"):
+        if provider == "cc3501e":
+            lines.append("# BLE: CC3501E is controlled by the Zephyr/companion path.")
+        else:
+            if linux_owned:
+                lines.append(
+                    "# BLE: Linux owns this provider's HCI path; BSP/machine "
+                    "recipes supply controller firmware.")
+            add_unique(image_pkgs, "bluez5")
+
+    if iot.get("mqtt"):
+        add_unique(packageconfig, "mqtt")
+
+    if iot.get("tls"):
+        add_unique(packageconfig, "security")
+        add_unique(image_pkgs, "ca-certificates")
+
+    if image_pkgs:
+        lines.append(f'IMAGE_INSTALL:append = " {" ".join(image_pkgs)}"')
+    if packageconfig:
+        lines.append(
+            f'PACKAGECONFIG:append:pn-alp-sdk = " {" ".join(packageconfig)}"')
+
+    return lines
+
+
+def _emit_baseline(slice_: Slice, diagnostics: dict[str, Any]) -> list[str]:
+    """Baseline Kconfig lines: the fragment header comment + the core
+    log/print enables every Zephyr slice gets regardless of what it
+    declares in board.yaml.
+    """
+    lines: list[str] = []
+    lines.append("# Auto-generated by scripts/alp_orchestrate.py "
+                 "-- do not edit.")
+    lines.append(f"# Per-core Kconfig fragment for slice "
+                 f"`{slice_.core_id}` ({slice_.os}).")
+    lines.append("")
+    lines.append("CONFIG_ALP_SDK=y")
+    lines.append("CONFIG_LOG=y")
+    lines.append("CONFIG_PRINTK=y")
+    if diagnostics.get("last_error", True):
+        lines.append("CONFIG_THREAD_LOCAL_STORAGE=y")
+    log_level = diagnostics.get("log_level")
+    if log_level is not None:
+        log_level_kc = {
+            "error": 1, "warn": 2, "info": 3, "debug": 4, "trace": 4,
+        }
+        if log_level in log_level_kc:
+            lines.append(f"CONFIG_LOG_DEFAULT_LEVEL={log_level_kc[log_level]}")
+    lines.append("")
+    return lines
+
+
+def _emit_console(diagnostics: dict[str, Any], slice_: Slice,
+                  project: Optional[BoardProject] = None) -> list[str]:
+    """Console backend, auto-selected from the slice OS (overridable via
+    board.yaml `diagnostics.console:`).  A Zephyr slice defaults to the
+    Alp UART console so `west build && attach a terminal` just works;
+    a customer on a serial-less bench flips to `ram`.
+
+    `diagnostics.sim_console: true` (issue #686) upgrades the AUTO-resolved
+    console of a HEADLESS core (`hw_console: false` -- no HW UART, e.g. the
+    RZ/V2N M33 system-manager) to the RAM console, so the studio simulator's
+    `uart_socket` isn't silent.  Precedence: an explicit `diagnostics.
+    console:` always wins; a core that has a UART console is simulated
+    through its real UART node and needs no Kconfig change.
+    """
+    raw = diagnostics.get("console")
+    console = _resolve_console(raw, slice_.os, slice_.hw_console)
+    auto = (raw or "auto").strip().lower() == "auto"
+    # A headless AUTO core resolves to "none" (above); `sim_console: true`
+    # upgrades it to the RAM console so the studio simulator's uart_socket
+    # isn't silent (#686).  Precedence: an explicit `diagnostics.console:`
+    # (auto == False) always wins and is never upgraded.
+    sim = bool(diagnostics.get("sim_console")) and auto \
+        and not slice_.hw_console and console == "none"
+    if sim:
+        console = "ram"
+    # `diagnostics.link: itcm` (tan-cli#1350): a Flow C RAM-run's default
+    # observable is the RAM console, so an AUTO console is promoted to it.  An
+    # explicit `console: uart` is NOT promoted: it keeps the board UART console
+    # and `link_target.itcm_conf` emits no RAM-console bits for it
+    # (tan-cli#1374).  linux/none are refused by the loader (alp is a uart alias).
+    if auto and link_applies_to(diagnostics, slice_):
+        console = "ram"
+    ram_size = _RAM_CONSOLE_MIN_SIZE
+    if console == "ram" and project is not None:
+        ram_size = max(ram_size, _app_ram_console_size(project, slice_))
+    return _emit_zephyr_console(console, sim_console=sim, ram_size=ram_size)
+
+
+# Alif "high-perf"/"high-efficiency" M55 pair -> the "M55-HP"/"M55-HE"
+# short form the boot banner and Alif's own docs use, in place of the
+# fuller "Cortex-M55" every other core type gets (_core_display_label).
+_M55_SUBTYPE_SUFFIX = {"high-perf": "HP", "high-efficiency": "HE"}
+
+
+def _core_display_label(core: dict[str, Any]) -> str:
+    """Boot-banner label for one `soc_spec["cores"]` entry.
+
+    "Cortex-<X>" from the `type` field for the general case (e.g.
+    "cortex-a32" -> "Cortex-A32"); the Alif M55 HP/HE pair gets the
+    shorter "M55-HP"/"M55-HE" form instead, because that IS the name
+    Alif's own docs and the AEN board trees use for them -- printing
+    "Cortex-M55-HE" nobody else calls it that would be its own kind of
+    dishonesty.  Falls back to the bare (uppercased) type string when it
+    is not a "cortex-*" type at all (e.g. an NPU-only or vendor-specific
+    core class no SoC spec in the catalogue uses today).
+    """
+    ctype = str(core.get("type") or "").strip()
+    subtype = str(core.get("subtype") or "").strip().lower()
+    if ctype == "cortex-m55" and subtype in _M55_SUBTYPE_SUFFIX:
+        return f"M55-{_M55_SUBTYPE_SUFFIX[subtype]}"
+    if ctype.lower().startswith("cortex-"):
+        return "Cortex-" + ctype.split("-", 1)[1].upper()
+    return ctype.upper() if ctype else "core"
+
+
+def _soc_cpu_complement(soc_spec: dict[str, Any], active_core_id: Optional[str]) -> str:
+    """Pre-formatted core list for `CONFIG_ALP_SDK_SOC_CPUS`: every core
+    the SoC JSON declares, the active one marked and listed first --
+    e.g. "M55-HE @160MHz (active) + M55-HP @400MHz + 2x Cortex-A32
+    @800MHz".  A core with no `freq_mhz` (e.g. an internal-companion NPU
+    core with no independent clock in the SoC JSON) prints its label with
+    no `@...MHz` suffix rather than a fabricated frequency.
+    """
+    cores = list(soc_spec.get("cores") or [])
+    cores.sort(key=lambda c: 0 if c.get("id") == active_core_id else 1)
+    parts: list[str] = []
+    for core in cores:
+        label = _core_display_label(core)
+        count = core.get("count") or 1
+        freq = core.get("freq_mhz")
+        prefix = f"{int(count)}x " if isinstance(count, (int, float)) and count > 1 else ""
+        freq_str = f" @{int(freq)}MHz" if isinstance(freq, (int, float)) else ""
+        marker = " (active)" if core.get("id") == active_core_id else ""
+        # `|<cluster>` lets alp_banner.c move the marker to the core the
+        # image is actually built for (alp-sdk#2469) -- see
+        # src/zephyr/alp_soc_cpus.h.
+        cluster = core.get("zephyr_cpucluster")
+        tag = f"|{cluster}" if cluster else ""
+        parts.append(f"{prefix}{label}{freq_str}{marker}{tag}")
+    return " + ".join(parts)
+
+
+def _soc_npu_complement(soc_spec: dict[str, Any]) -> str:
+    """Pre-formatted NPU list for `CONFIG_ALP_SDK_SOC_NPUS`, e.g.
+    "Ethos-U85 + 2x Ethos-U55" -- same-`type` NPU instances (e.g. the
+    E8's two Ethos-U55s, one per M55 core) are grouped into a single
+    "Nx <Label>" entry rather than repeated, in the order their `type`
+    first appears in `soc_spec["npus"]`.
+    """
+    order: list[str] = []
+    counts: dict[str, int] = {}
+    for npu in (soc_spec.get("npus") or []):
+        ntype = str(npu.get("type") or "").strip()
+        if not ntype:
+            continue
+        label = "-".join(seg.capitalize() for seg in ntype.split("-"))
+        if label not in counts:
+            order.append(label)
+        counts[label] = counts.get(label, 0) + 1
+    return " + ".join(
+        f"{counts[label]}x {label}" if counts[label] > 1 else label
+        for label in order)
+
+
+def _soc_display_name(soc_spec: dict[str, Any]) -> str:
+    """Vendor + family + part for `CONFIG_ALP_SDK_SOC_NAME`, e.g. "Alif
+    Ensemble E8".  `vendor` contributes only its first word (Alif
+    Semiconductor -> Alif); `part` is dropped when it already restates
+    `family` verbatim as a prefix (e.g. family "Ensemble" / part "Ensemble E8"
+    would otherwise read "Alif Ensemble Ensemble E8").
+    """
+    vendor = str(soc_spec.get("vendor") or "").strip()
+    family = str(soc_spec.get("family") or "").strip()
+    part = str(soc_spec.get("part") or "").strip()
+    vendor_short = vendor.split()[0] if vendor else ""
+    if family and part and part.startswith(family):
+        segments = [vendor_short, part]
+    else:
+        segments = [vendor_short, family, part]
+    return " ".join(s for s in segments if s)
+
+
+def _emit_soc_summary(project: "BoardProject", slice_: "Slice") -> list[str]:
+    """Boot-banner identity + system-summary Kconfig (`CONFIG_ALP_SDK_
+    SOC_*` / `CONFIG_ALP_SDK_SOM_*_MBIT`, `zephyr/kconfigs/core.kconfig`).
+
+    Every field here is transcribed, never invented, from data this
+    project already resolved: the SoC spec JSON (`project.soc_spec` --
+    `cores[]`, `npus[]`, `soc_ram_kb`, `soc_flash_mb`, the on-die SRAM +
+    MRAM the SoC itself carries) for the CONFIG_ALP_SDK_SOC_* facts, and
+    the SoM preset's `memory:` block (off-SoC OSPI RAM/flash the SKU's
+    BOM actually populates -- distinct from the SoC facts above: two SKUs
+    on the identical PCB/silicon can differ here, e.g. E1M-AEN803's 512
+    Mbit HyperRAM + 256 Mbit NOR vs E1M-AEN801, which populates neither)
+    for CONFIG_ALP_SDK_SOM_{DRAM,FLASH}_MBIT.
+
+    `alp_banner.c` prefers these over its devicetree fallback (one
+    image's chosen sram/flash REGION size, not the SoM's actual
+    hardware) whenever `CONFIG_ALP_SDK_SOC_CPUS` is non-empty -- see that
+    file's module docstring.  A project whose SoC spec is missing a field
+    (no `npus`, no `soc_ram_kb`, ...) still gets whatever IS known; only
+    `CONFIG_ALP_SDK_SOC_NAME`/`_CPUS` gate the whole banner section on the
+    C side, so those two are the only ones this function must guarantee
+    non-empty whenever `project.soc_spec` resolves at all.
+    """
+    soc_spec = project.soc_spec or {}
+    lines: list[str] = [
+        "# Boot-banner SoC identity + system summary (from the SoC spec "
+        "JSON + SoM preset `memory:`; see alp_banner.c).",
+    ]
+
+    name = _soc_display_name(soc_spec)
+    if name:
+        lines.append(f'CONFIG_ALP_SDK_SOC_NAME="{name}"')
+
+    cpus = _soc_cpu_complement(soc_spec, slice_.core_id)
+    if cpus:
+        lines.append(f'CONFIG_ALP_SDK_SOC_CPUS="{cpus}"')
+
+    npus = _soc_npu_complement(soc_spec)
+    if npus:
+        lines.append(f'CONFIG_ALP_SDK_SOC_NPUS="{npus}"')
+
+    soc_ram_kb = soc_spec.get("soc_ram_kb")
+    if isinstance(soc_ram_kb, (int, float)) and soc_ram_kb > 0:
+        lines.append(f"CONFIG_ALP_SDK_SOC_SRAM_KB={int(soc_ram_kb)}")
+
+    soc_flash_mb = soc_spec.get("soc_flash_mb")
+    if isinstance(soc_flash_mb, (int, float)) and soc_flash_mb > 0:
+        lines.append(f"CONFIG_ALP_SDK_SOC_MRAM_KB={int(round(soc_flash_mb * 1024))}")
+
+    # Off-SoC OSPI memory the SoM SKU actually populates (som-preset
+    # `memory:` -- a MODULE fact, not a SoC one; see the SKU contrast
+    # above).  `is_tbd`/absent/non-positive all mean "don't claim it".
+    mem = project.som_preset.get("memory") or {}
+    dram_mbit = mem.get("dram_mbit")
+    if isinstance(dram_mbit, (int, float)) and not _is_tbd(dram_mbit) and dram_mbit > 0:
+        lines.append(f"CONFIG_ALP_SDK_SOM_DRAM_MBIT={int(dram_mbit)}")
+    flash_mbit = mem.get("flash_mbit")
+    if isinstance(flash_mbit, (int, float)) and not _is_tbd(flash_mbit) and flash_mbit > 0:
+        lines.append(f"CONFIG_ALP_SDK_SOM_FLASH_MBIT={int(flash_mbit)}")
+
+    lines.append("")
+    return lines
+
+
+def _emit_som_caps(
+    project: "BoardProject",
+    silicon: Optional[str],
+    kconfig: Optional[str],
+) -> list[str]:
+    """SoM-capability Kconfig lines: HW-manifest EEPROM wiring, the
+    resolved SoM-silicon Kconfig symbol, and the cross-EVK board facade /
+    `<alp/soc_caps.h>` capability-restriction selector.
+    """
+    lines: list[str] = []
+
+    # HW manifest EEPROM: the SoM preset provides the default bus,
+    # while board.yaml `features.hw_info.eeprom` can pin the exact
+    # app/project address and manifest offset.  Harmless on examples
+    # without that bus wired: the read returns NOT_READY and the banner
+    # says so.
+    hw_info_eeprom = project.hw_info_eeprom_config()
+    if hw_info_eeprom is not None:
+        source = hw_info_eeprom.get("source")
+        if source == "features.hw_info.eeprom":
+            lines.append(
+                "# HW manifest EEPROM from board.yaml `features.hw_info.eeprom`;")
+        else:
+            lines.append("# On-module HW manifest EEPROM -> portable bus 0 (alp-i2c0);")
+        lines.append("# enables alp_hw_info_read() + the console banner manifest line.")
+        lines.append(
+            "CONFIG_ALP_SDK_HW_INFO_EEPROM_I2C_BUS_ID="
+            f"{hw_info_eeprom['bus_id']}")
+        if source == "features.hw_info.eeprom":
+            lines.append(
+                "CONFIG_ALP_SDK_HW_INFO_EEPROM_ADDR_7BIT="
+                f"0x{hw_info_eeprom['addr_7bit']:02x}")
+            lines.append(
+                "CONFIG_ALP_SDK_HW_INFO_EEPROM_OFFSET="
+                f"{hw_info_eeprom['offset']}")
+        lines.append("")
+
+    # Build-time hw_rev this project resolved -- lets the boot banner warn
+    # when the LIVE EEPROM manifest disagrees (issue #1853).  Emitted
+    # unconditionally (not scoped to the `hw_info_eeprom` block above): a
+    # SKU with no on_module.eeprom today still gets the
+    # symbol, so it isn't silently dropped if that SKU gains an EEPROM
+    # later, and it stays harmless meanwhile (alp_hw_info_read() never
+    # returns ALP_OK without a bus, so the banner's compare never runs).
+    # Same `hw_rev or ... or "unknown"` fallback chain as
+    # alp_project_emit/hw_info.py's `_emit_hw_info_h` (project.hw_rev is
+    # already `som.hw_rev or default_hw_rev`; add the same "unknown"
+    # floor here so the two resolvers can't disagree on the empty case).
+    # Emit the composed board designator (`2626-r2`), not the bare revision key,
+    # because that is what the module's EEPROM identity carries -- and this symbol
+    # exists only to be compared against it.  Getting this wrong is not cosmetic:
+    # CONFIG_ALP_SDK_HW_REV_MISMATCH_FATAL promotes the banner's mismatch warning
+    # to k_panic(), so a write side that composes and a compare side that does not
+    # would halt boot on a correctly provisioned module.
+    #
+    # project.hw_rev itself stays the BARE key -- loader.py passes it to
+    # family_revision_known() as a lookup key into hw_revisions, where a composed
+    # value would not resolve.
+    _som_hw_rev = project.hw_rev
+    if _som_hw_rev:
+        from .loader import _sku_family_dir
+        _fam = _sku_family_dir(project.sku)
+        if _fam:
+            _som_hw_rev = _sdk_compat.board_designator(
+                _sdk_compat.load_family_table(project.effective_metadata_root(), _fam),
+                _som_hw_rev)
+    lines.append(f'CONFIG_ALP_SDK_SOM_HW_REV="{_som_hw_rev or "unknown"}"')
+    lines.append("")
+
+    if kconfig:
+        lines.append(f"# SoM silicon ({silicon} via {project.sku})")
+        lines.append(f"CONFIG_{kconfig}=y")
+        lines.append("")
+
+    # Cross-EVK board facade selector (<alp/board.h>).
+    # Emitted only when the project resolves to a named board preset
+    # (e.g. `preset: e1m-x-evk` -> board_name "E1M-X-EVK").
+    # CONFIG_COMPILER_OPT passes the define into every source file the
+    # Zephyr build compiles, so the facade header can resolve the
+    # correct EVK-specific BOARD_* aliases without per-app prj.conf
+    # entries or extra_args.  Inline boards (no preset/name) skip this;
+    # native_sim testcases that do need the define set it via extra_args.
+    # Per-SKU capability-restriction gate for <alp/soc_caps.h>: emitted
+    # ONLY when the SoM preset declares `silicon_capabilities.unpopulated`
+    # (no SKU in the current catalogue does), so unrestricted SKUs keep a
+    # byte-identical fragment.  Folded into the same CONFIG_COMPILER_OPT
+    # string as the board facade define because that Kconfig is
+    # single-value (last write wins, not additive).
+    som_def = ""
+    if som_unpopulated_capabilities(project.som_preset):
+        som_def = f"-DALP_SOM_{_som_define_slug(project.sku)}"
+    if project.board_name:
+        # Cross-EVK board facade selector for <alp/board.h>.  NOTE:
+        # CONFIG_COMPILER_OPT is a single-value Kconfig string (last write
+        # wins, not additive) -- an app must NOT also set it in prj.conf or
+        # this -D is silently dropped; pass extra defines another way.
+        lines.append("# Cross-EVK board facade selector (<alp/board.h>);"
+                     " CONFIG_COMPILER_OPT is single-value (do not also set in prj.conf).")
+        if som_def:
+            lines.append("# + ALP_SOM_* capability-restriction gate: this SKU "
+                         "leaves silicon capabilities unpopulated "
+                         "(SoM preset silicon_capabilities.unpopulated).")
+        opt = f"-DALP_BOARD_{_board_define_slug(project.board_name)}"
+        if som_def:
+            opt = f"{opt} {som_def}"
+        lines.append(f'CONFIG_COMPILER_OPT="{opt}"')
+        lines.append("")
+    elif som_def:
+        lines.append("# ALP_SOM_* capability-restriction gate (<alp/soc_caps.h>);"
+                     " CONFIG_COMPILER_OPT is single-value (do not also set in prj.conf).")
+        lines.append(f'CONFIG_COMPILER_OPT="{som_def}"')
+        lines.append("")
+
+    return lines
+
+
+def _slug_kconfig(slug: str) -> str:
+    """Map a chip/block slug to its Kconfig symbol (CHIP_ or BLOCK_)."""
+    kind = "BLOCK" if slug in _BLOCK_SLUGS else "CHIP"
+    return f"CONFIG_ALP_SDK_{kind}_{slug.upper()}"
+
+
+def _resolve_chip_states(project: "BoardProject") -> dict[str, bool]:
+    """Final resolved on/off state for every chip/block slug the project
+    touches -- the single source of truth `_emit_chips` prints its
+    `CONFIG_ALP_SDK_CHIP_*=` lines FROM (so the printed line and this map
+    can never disagree by construction) and any other emitter (e.g.
+    `_zephyr_iot_kconfig`'s CC3501E Wi-Fi/BLE gate) consults before gating
+    a dependent symbol (issue #874).
+
+    Precedence: on-module presence is the physical baseline (always
+    True). An explicit `populated: {chip: true/false}` entry then applies
+    the board's stated population, on-module chip or not. Finally, a
+    project-declared `chips:` entry can still turn a board-DNI'd chip ON
+    -- the documented escape hatch for a project that wires up a sensor
+    the board preset doesn't populate by default (e.g. `ai/cold-chain-
+    monitor`'s `chips: [bme280]` overriding the EVK preset's `populated:
+    {bme280: false}`) -- UNLESS the chip is ALSO on-module: an on-module
+    (SoM-intrinsic) component is fixed at SoM-fab time (see the `som:`
+    block's own description in board.schema.json) and re-listing it in
+    `chips:` is a redundant declaration, not a fresh override, so it must
+    not silently flip a board's `populated: {chip: false}` back on for a
+    chip ALSO claimed on-module (issue #874 follow-up: the triple-overlap
+    case -- on-module + populated:false + project `chips:` all naming the
+    same chip -- used to let the project-chips pass win regardless,
+    re-creating the exact WIFI_CC3501E=y-against-chip=n contradiction
+    #874 fixed).
+    """
+    states: dict[str, bool] = {}
+
+    som_chips: set[str] = set()
+    om = project.som_preset.get("on_module") or {}
+    for slug in _slugs_from_on_module(om):
+        som_chips.add(slug)
+    hf = project.som_preset.get("helper_firmware") or []
+    for slug in _slugs_from_helper_firmware(hf):
+        som_chips.add(slug)
+    for chip in som_chips:
+        states[chip] = True
+
+    populated: dict[str, bool] = dict(
+        (project.board_preset or {}).get("populated") or {})
+    for chip, on in populated.items():
+        states[chip] = bool(on)
+
+    for chip in (project.chips or []):
+        if chip in som_chips:
+            continue
+        states[chip] = True
+
+    return states
+
+
+def _chip_has_driver(slug: str) -> bool:
+    """True when `chips/<slug>/` exists, i.e. there is something to compile.
+
+    This is the same criterion `_slugs_from_on_module` already applies to
+    `ospi_memories` and `hyperram`, whose docstring records the reason:
+    those parts have "no `chips/<part>/` driver, so their MPNs are NOT
+    extracted as chip slugs (emitting them as `CONFIG_ALP_SDK_CHIP_<X>`
+    would trip Zephyr's undefined-symbol guard)". The rule is applied there
+    per-field; it has to hold per-chip too, because a scalar `on_module:`
+    field can name a real chip manifest that has no driver behind it.
+
+    Driver presence is checked on disk rather than read from the manifest's
+    `driver_status:`, because the directory is what the Kconfig declaration
+    actually points at -- every entry in `zephyr/kconfigs/chips.kconfig`
+    reads "Compile chips/<part>/<part>.c". A status string can drift from
+    the tree; the directory cannot.
+
+    `REPO` is the BOUND alp-sdk checkout (`tan.planner_root`), not tan's own
+    tree -- `chips/` is a fact and facts did not relocate (ADR-0017).
+    """
+    return (REPO / "chips" / slug).is_dir()
+
+
+@lru_cache(maxsize=1)
+def _declared_chip_symbols() -> frozenset[str]:
+    """Every `ALP_SDK_CHIP_*` symbol the BOUND alp-sdk actually declares.
+
+    Parsed from the SDK's own `zephyr/**/*.kconfig` rather than inferred, so
+    this is the same fact Zephyr resolves against. Measured on alp-sdk `dev`:
+    80 declarations, all in `zephyr/kconfigs/chips.kconfig`, matching the 80
+    `chips/<slug>/` directories exactly.
+
+    An empty result means the SDK's kconfigs could not be read at all; the
+    caller treats that as "cannot verify" and stays silent rather than
+    refusing every build on a layout this parser does not understand.
+    """
+    declared: set[str] = set()
+    for path in sorted((REPO / "zephyr").rglob("*.kconfig")):
+        try:
+            text = path.read_text(encoding="utf-8", errors="replace")
+        except OSError:
+            continue
+        declared.update(re.findall(r"^config (ALP_SDK_CHIP_\w+)", text, re.M))
+    return frozenset(declared)
+
+
+def _assert_chip_symbols_declared(slugs: "list[str]") -> None:
+    """Refuse to write a `CONFIG_` line the bound SDK cannot resolve (#728).
+
+    `_chip_has_driver` decides what to emit from `chips/<slug>/` on disk.
+    That is the right *intent* -- the directory is what the declaration
+    compiles -- but it is an inference, and Zephyr resolves the declaration.
+    When the two disagree, the emitted line reaches Kconfig as
+
+        alp.conf:28: warning: attempt to assign the value 'y' to the
+        undefined symbol ALP_SDK_CHIP_DP83825
+        error: Aborting due to Kconfig warnings
+
+    which blames the app's generated config for a planner/SDK skew and takes
+    out `tan build` for the whole SoM. That is how tan-cli#728 presented:
+    released `tan 0.5.1`, whose vendored planner predates alp-sdk#1241/#1322,
+    against an alp-sdk `dev` whose `ethernet_phy: dp83825` made an undriven
+    chip reachable from `on_module:` for the first time.
+
+    A released binary cannot be retro-fixed, so this does not repair 0.5.1 --
+    it stops the NEXT skew of this class from being discovered by Zephyr. The
+    refusal names the symbol and the SDK, so the reader knows which pair
+    disagrees rather than hunting a `CONFIG_` line they never wrote.
+
+    Silent when the SDK declares nothing this parser recognises: an
+    unreadable or restructured kconfig tree is a reason to stay out of the
+    way, not to refuse every build. Verification is the goal, not gatekeeping
+    on a layout assumption.
+    """
+    declared = _declared_chip_symbols()
+    if not declared:
+        return
+    undeclared = sorted(
+        s for s in slugs
+        if (sym := _slug_kconfig(s).removeprefix("CONFIG_")).startswith("ALP_SDK_CHIP_")
+        and sym not in declared
+    )
+    if not undeclared:
+        return
+    names = ", ".join(f"{_slug_kconfig(s)} (chip `{s}`)" for s in undeclared)
+    raise OrchestratorError(
+        f"the bound alp-sdk at {REPO} declares no Kconfig symbol for "
+        f"{names}. Emitting it would write an assignment Zephyr cannot "
+        f"resolve, failing the build with `attempt to assign the value 'y' "
+        f"to the undefined symbol` and blaming the generated alp.conf. This "
+        f"means tan's planner and this SDK disagree about which chips have "
+        f"drivers -- usually a tan too old for the SDK (tan-cli#728). Update "
+        f"tan, or bind an alp-sdk matching this tan."
+    )
+
+
+def _emit_chips(
+    project: "BoardProject",
+    chip_subsystems_table: dict[str, tuple[str, ...]],
+) -> tuple[list[str], set[str], dict[str, bool]]:
+    """SoM-intrinsic + board-populated + project-declared chip drivers.
+
+    Every `CONFIG_ALP_SDK_CHIP_*=` / `CONFIG_ALP_SDK_BLOCK_*=` line is
+    printed FROM `_resolve_chip_states`'s resolved map (single source of
+    truth, issue #874) and printed EXACTLY ONCE regardless of how many of
+    the three sources below mention it -- a chip already printed by an
+    earlier block is skipped by a later one rather than re-asserted with
+    a value that could disagree.
+
+    Returns the emitted Kconfig lines, the accumulated set of Zephyr
+    subsystem names the enabled chip drivers require -- fed into
+    `_emit_subsystems` alongside the slice's `peripherals:` array -- and
+    the resolved chip on/off map.
+    """
+    lines: list[str] = []
+    chip_subsystems: set[str] = set()
+    resolved_chip_state = _resolve_chip_states(project)
+    printed: set[str] = set()
+
+    def _emit_block(header: str, candidates) -> None:
+        chips = sorted(c for c in set(candidates) if c not in printed)
+        if not chips:
+            return
+        _assert_chip_symbols_declared(chips)
+        lines.append(header)
+        for chip in chips:
+            on = resolved_chip_state.get(chip, False)
+            lines.append(f"{_slug_kconfig(chip)}={'y' if on else 'n'}")
+            printed.add(chip)
+            if on:
+                for s in chip_subsystems_table.get(chip, ()):
+                    chip_subsystems.add(s)
+        lines.append("")
+
+    # ----------------------------------------------------------------
+    # SoM-intrinsic chip drivers — derived from on_module: + helper_firmware:
+    # in the SoM preset.  These are NOT declared by the customer; they
+    # are determined by which SoM SKU the project targets.  Swapping
+    # `som.sku:` from E1M-V2N101 to E1M-AEN801 automatically swaps
+    # the on-module chip set without any board.yaml changes.
+    # ----------------------------------------------------------------
+    som_chips: set[str] = set()
+    om = project.som_preset.get("on_module") or {}
+    if om:
+        for slug in _slugs_from_on_module(om):
+            som_chips.add(slug)
+    hf = project.som_preset.get("helper_firmware") or []
+    for slug in _slugs_from_helper_firmware(hf):
+        som_chips.add(slug)
+
+    # A CONFIG_ALP_SDK_CHIP_<X> line is only meaningful when the symbol
+    # exists, and the symbol only exists when there is a driver to compile:
+    # every declaration in zephyr/kconfigs/chips.kconfig reads "Compile
+    # chips/<part>/<part>.c".  A manifest whose driver_status says no such
+    # driver exists therefore has no symbol, and emitting the line anyway
+    # writes a CONFIG_ assignment Zephyr cannot resolve (alp-sdk#1241).
+    #
+    # Measured over metadata/chips/*.yaml when this was added: 77 of 81
+    # chips carry a declared symbol -- every `complete`, `partial` and
+    # `stub` one, each with a real chips/<part>/ directory.  The only
+    # undeclared ones are the four `planned` Murata modules, which no SoM
+    # populates.  `ethernet_phy: dp83825` made an undriven chip reachable
+    # from on_module: for the first time, which is how this surfaced.
+    #
+    # The chip stays in metadata -- it is real, populated hardware, and the
+    # manifest is what documents the ADR-0023 layer-3 gap.  It just does not
+    # get a driver-selection Kconfig it has no driver for.
+    som_chips = {s for s in som_chips if _chip_has_driver(s)}
+
+    _emit_block(
+        f"# SoM-intrinsic chip drivers (from `{project.sku}` "
+        f"on_module + helper_firmware)", som_chips)
+
+    # ----------------------------------------------------------------
+    # Board-populated chip drivers.  Single source: the resolved
+    # board_preset dict, which comes from either the shared
+    # metadata/boards/<preset>.yaml or the project's inline
+    # top-level fields (synthesised by the loader).  No project-level
+    # override merge -- the schema's `oneOf` rule rejects mixing.
+    #
+    # Chip drivers compile per-chip via the
+    # zephyr_library_sources_ifdef(CONFIG_ALP_SDK_CHIP_<NAME> ...)
+    # (or CONFIG_ALP_SDK_BLOCK_<NAME> for the `button_led` / `pdm_mic`
+    # SDK-level block helpers) entries in zephyr/CMakeLists.txt.
+    #
+    # We emit the chip-driver block on every zephyr slice — Kconfig
+    # dedupes when multiple per-core fragments overlay onto the same
+    # base.  This keeps `--core <id>` invocations self-sufficient
+    # (the slice carries everything it needs to compile) without
+    # depending on cross-slice ordering.
+    # ----------------------------------------------------------------
+    populated: dict[str, bool] = dict(
+        (project.board_preset or {}).get("populated") or {})
+    _emit_block(
+        "# Board-populated chip drivers (from the resolved "
+        "board definition)", populated.keys())
+
+    # Project-declared chips (board.yaml top-level `chips:` array).
+    # Adds chip drivers the application links directly via
+    # <alp/chips/<name>.h> -- e.g. when the project plugs an external
+    # sensor into a board's headers that's not in the board's
+    # `populated:` table, or turns ON a chip the board preset DNIs by
+    # default (`_resolve_chip_states` already folded that override into
+    # the resolved value the "Board-populated" block above printed, so
+    # there is nothing left to print here for such a chip -- this block
+    # only has fresh lines for chips `populated:` never mentioned at
+    # all).  A chip that's ALSO on-module never reaches here with a
+    # different value than the SoM-intrinsic block already printed
+    # (`_resolve_chip_states` deliberately does not let a project
+    # `chips:` entry override an on-module chip's resolved state).
+    _emit_block(
+        "# Project-declared chips (board.yaml `chips:` array)",
+        project.chips or [])
+
+    return lines, chip_subsystems, resolved_chip_state
+
+
+def _emit_subsystems(
+    project: BoardProject, slice_: Slice, chip_subsystems: set[str]
+) -> list[str]:
+    """Zephyr subsystems required by the slice: union of (chip-driver-
+    required subsystems, from `_emit_chips`) and (this core's
+    `peripherals:` array, which adds to the union per spec §4.6).
+    """
+    lines: list[str] = []
+    periph_kconfig = peripheral_kconfig(project.effective_metadata_root())
+    periph_subsystems: set[str] = set()
+    for periph in slice_.peripherals or []:
+        periph_subsystems.update(periph_kconfig.get(periph, ()))
+    all_subsystems = chip_subsystems | periph_subsystems
+    if all_subsystems:
+        lines.append(f"# Zephyr subsystems required on core "
+                     f"`{slice_.core_id}` (chip drivers + peripherals)")
+        for s in sorted(all_subsystems):
+            lines.append(f"CONFIG_{s}=y")
+        lines.append("")
+    return lines
+
+
+def _per_core_library_kconfig(
+        lib: str,
+        manifest: Optional[dict],
+        metadata_root: Path) -> Optional[list[str]]:
+    """Base-Kconfig lines for a per-core `libraries:` token, read from the
+    library's ADR 0018 manifest (metadata/libraries/<canonical>.yaml) rather
+    than a hand-maintained table (WS6-c #610 §6).
+
+    `manifest` is the already-resolved document from the ADR-0018 library
+    layer (`libraries.resolve_selection`); pass it so the per-core channel
+    reads exactly what the layer validated instead of re-reading the file
+    behind the layer's back (alplabai/tan-cli#555).  Pass `None` and the
+    token is resolved to its canonical manifest through the
+    metadata/library-aliases-v1.json alias table (read from `metadata_root`,
+    the SAME tree `load_board_yaml(..., metadata_root=...)` resolved this
+    project against -- #1485) and loaded here.
+
+    The emitted set is the union of the manifest's
+    `integration.zephyr.kconfig` (the upstream module-enable line(s)) and its
+    `integration.zephyr.hw_backends.sw_fallback.kconfig` (the SDK SW floor),
+    module-enable first and the SW-fallback marker last, deduped -- computed
+    by `libraries.zephyr_library_kconfig`, the same derivation the
+    project-wide channel (`libraries.zephyr_kconfig_lines`) calls, so a
+    library's base Kconfig set cannot drift between the two declaration
+    channels (#1359).
+
+    Returns None when no manifest resolves (caller emits the pending-wire TODO).
+    """
+    doc = manifest
+    if doc is None:
+        alias = _library_alias_table(metadata_root)
+        canonical = alias.get(lib, lib)
+        path = metadata_root / "libraries" / f"{canonical}.yaml"
+        if not path.is_file():
+            return None
+        doc = yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+    return _library_layer.zephyr_library_kconfig(doc)
+
+
+def _emit_libraries(
+    project: "BoardProject",
+    slice_: Slice,
+) -> list[str]:
+    """Per-core `libraries:`, curated third-party `libraries:` (ADR 0018),
+    and the open-set `extra_libraries:` escape hatch (v0.6 P2.1).
+
+    Per-core Kconfig is resolved from each library's manifest
+    (`_per_core_library_kconfig`), not a hand-maintained enable table.
+
+    Both the project-wide and the core-scoped declaration channels go through
+    the SAME ADR-0018 layer: `libraries.resolve_selection(..., slice_=)` is
+    what refuses an unknown name, a failed `requires:` constraint or a library
+    that cannot be wired on this target, and it is resolved FIRST so that
+    refusal lands before a single line is emitted (alplabai/tan-cli#555).
+    """
+    lines: list[str] = []
+
+    # name -> validated manifest for every library in scope on this slice.
+    resolved: dict[str, dict] = {}
+    if slice_.os == "zephyr":
+        resolved = dict(_library_layer.resolve_selection(
+            project, project.effective_metadata_root(), slice_=slice_))
+
+    if slice_.libraries:
+        lines.append(f"# Libraries declared on core "
+                     f"`{slice_.core_id}`")
+        for lib in sorted(slice_.libraries):
+            kcs = _per_core_library_kconfig(
+                lib, resolved.get(lib), project.effective_metadata_root())
+            if kcs is None:
+                lines.append(
+                    f"# TODO: wire library '{lib}' once its v0.4 enable lands")
+            else:
+                for kc in kcs:
+                    lines.append(kc)
+        lines.append("")
+
+    # Project-wide curated third-party libraries (top-level `libraries:`,
+    # ADR 0018).  Emitted from the metadata/libraries/<name>.yaml manifests;
+    # resolve_selection() has already rejected any incompatible selection.
+    # Guard keeps a project with no `libraries:` byte-identical.
+    library_lines = _library_layer.zephyr_kconfig_lines(
+        project, slice_, project.effective_metadata_root())
+    if library_lines:
+        lines.append("# Curated third-party libraries "
+                     "(project `libraries:`, ADR 0018)")
+        lines.extend(library_lines)
+        lines.append("")
+
+    # ----------------------------------------------------------------
+    # Open-set extra_libraries (v0.6 P2.1).  Each entry declares either
+    # inline `kconfig:` lines (emitted verbatim) or a `profile:` path
+    # to a hw-backends.yaml-style file we walk with the same silicon /
+    # soc_family / requires_cap matcher as the curated libraries.
+    # _validate_consistency() guarantees exactly-one of kconfig/profile
+    # and the profile file resolves, so the per-entry checks here are
+    # just for emit-time safety.
+    # ----------------------------------------------------------------
+    if slice_.extra_libraries:
+        lines.append(f"# Extra libraries declared on core "
+                     f"`{slice_.core_id}` (open-set escape hatch)")
+        for entry in sorted(slice_.extra_libraries,
+                            key=lambda e: e.get("name", "")):
+            name = entry.get("name", "<unnamed>")
+            kc_lines = entry.get("kconfig")
+            profile = entry.get("profile")
+            if kc_lines:
+                lines.append(f"# extra_libraries[{name}] (inline kconfig)")
+                for kc in kc_lines:
+                    lines.append(str(kc))
+            elif profile:
+                lines.append(f"# extra_libraries[{name}] (profile: {profile})")
+                profile_lines = _emit_extra_library_profile(
+                    name, profile, project)
+                if profile_lines:
+                    lines.extend(profile_lines)
+                else:
+                    lines.append(
+                        f"# (no matching backend for "
+                        f"silicon={project.som_preset.get('silicon')} "
+                        f"in {profile})")
+        lines.append("")
+
+    return lines
+
+
+def _slice_wants_inference(project: "BoardProject", slice_: Slice) -> bool:
+    """True when this slice genuinely uses `<alp/inference.h>`.
+
+    Two independent signals, either sufficient: `cores.<id>.inference:`
+    declared (app-level tuning, e.g. `default_arena_kib:` -- the signal
+    every inference example under examples/ai, examples/audio,
+    examples/camera-vision declares), OR the slice's `libraries:` scope
+    (project-wide AND core-scoped, via `libraries.scoped_names` -- #1359
+    follow-up: reading `slice_.libraries` alone missed a project-wide
+    `libraries: [tflite-micro]` entry) pulls in `tflite-micro` (resolved
+    through the same alias table `_per_core_library_kconfig` uses -- a
+    `cores:`-scoped top-level `libraries:` entry folds into
+    `slice_.libraries` at load time, see `loader.py::_normalize_libraries`).
+    The library signal exists because `cores.<id>.inference:` is app-level
+    TUNING, not a declaration of intent -- an app that never overrides the
+    arena default has no reason to write the block, and #874's adversarial
+    follow-up found exactly that false negative (`examples/camera-vision/
+    ai-object-detection-realtime`, `libraries: tflite-micro` with no
+    `inference:` block). A slice with NEITHER signal stays clean (no
+    unconditional emit returns, issue #874 item 4).
+    """
+    if slice_.inference:
+        return True
+    alias = _library_alias_table(project.effective_metadata_root())
+    return any(alias.get(lib, lib) == "tflite-micro"
+               for lib in _library_layer.scoped_names(project, slice_=slice_))
+
+
+def _emit_inference(
+    project: "BoardProject",
+    slice_: Slice,
+    silicon: Optional[str],
+) -> list[str]:
+    """Inference dispatcher enables, driven entirely by the SoM preset's
+    `capabilities:` matrix + SoC-JSON `cores[]` -- NOT by board.yaml.
+    The customer never picks *which backend* at build time; the SDK
+    compiles in every dispatcher the silicon supports, and apps choose
+    per-handle at runtime via alp_inference_open(.backend=...).
+    CPU/TFLM is the universal SW fallback and is on whenever this
+    section emits at all.
+
+    *Whether* the section emits anything is gated on `_slice_wants_inference`
+    (declared `cores.<id>.inference:` tuning OR a `libraries:` pull of
+    `tflite-micro`).  Emitting the backend switches unconditionally on
+    every zephyr slice used to put a misleading `=y` line (silently
+    resolving to n -- BACKEND_TFLM's `depends on TENSORFLOW_LITE_MICRO &&
+    CPP` are genuinely-external symbols not every slice's prj.conf sets)
+    in front of apps that never call alp_inference_open() at all
+    (issue #874).
+
+    Two layers of variant detail are emitted alongside the umbrella
+    switches so the SDK driver code + (upstream) kernel libraries
+    compile against the right per-silicon variant, each only alongside
+    the ALP_SDK_* parent it `depends on` in
+    zephyr/kconfigs/iot-audio-inference.kconfig (issue #874 item 3):
+
+      - CONFIG_ALP_SDK_INFERENCE_ETHOS_U_VARIANT_{U55,U85}=y -- derived
+        from the silicon capability counts (ethos_u{55,85}_count, resolved
+        from the SoC JSON npus[]), the single source for which NPUs the
+        part carries.  U85 carries Arm's larger MAC array + TensorOptimized
+        kernels; U55 carries the smaller MAC + reference kernels.
+        U55/U85 depend on BACKEND_ETHOS_U_AEN.
+
+      - CONFIG_ALP_SDK_INFERENCE_TFLM_KERNEL_{NEON,HELIUM,REF}=y -- picked
+        from the SoC JSON's `cores[<slice.core_id>].vector_extension`
+        so the CPU-side TFLM kernel set matches the target core's SIMD
+        reality (NEON on A-cluster, Helium MVE on M55, scalar / REF
+        on baseline M33 / M4).  Per-core in case a single SoM hosts
+        multiple core classes (E7 = A32 + M55, all three Helium /
+        Neon flavours).  All three depend on BACKEND_TFLM.
+    """
+    if not _slice_wants_inference(project, slice_):
+        return []
+
+    lines: list[str] = []
+
+    # resolve_capabilities merges SoC-JSON defaults with SoM overrides
+    # so silicon-determined caps (ethos_u55_count, drp_ai, ...) resolve
+    # even when removed from the SoM YAML (capability unification, slice 3b).
+    capabilities = resolve_capabilities(project.som_preset, project.effective_metadata_root())
+    inference_lines: list[str] = [
+        # BACKEND_TFLM depends on TENSORFLOW_LITE_MICRO && CPP -- genuinely
+        # external (upstream Zephyr / tflite-micro module) symbols, not
+        # ALP_SDK_*.  west.yml pulls the tflite-micro module in
+        # unconditionally (no west group gate; see west.yml's
+        # name-allowlist), so both resolve here rather than requiring every
+        # inference app to hand-write them in its own prj.conf (#874; see
+        # also #855 for cross-alp-sdk-version symbol skew).  This is
+        # effective on an alp-sdk-topdir west workspace (west.yml's own
+        # manifest); a workspace initialised off a bare upstream
+        # `zephyr` manifest (the repo's own twister CI, a plain
+        # `west init -m .../zephyr`) has no tflite-micro module at all,
+        # so TENSORFLOW_LITE_MICRO degrades gracefully to n (a Kconfig
+        # "assigned y but got n" warning, not fatal -- the inference
+        # dispatcher falls back to ALP_SDK_INFERENCE_SW_FALLBACK there).
+        "CONFIG_CPP=y",
+        # tflite-micro's headers require C++17 (e.g. tensorflow/lite/array.h
+        # uses std::conditional_t / std::decay_t).  Zephyr's C++ standard
+        # `choice STD_CPP` defaults to C++11, so a TFLM build compiled at
+        # -std=c++11 fails.  Emit C++17 here whenever inference (TFLM) is
+        # wanted so every inference project builds without hand-editing:
+        # real NPU apps previously set CONFIG_STD_CPP17=y in their own
+        # prj.conf; the emit now guarantees it on every platform (native_sim
+        # + real silicon alike), matching what the AEN NPU builds already use.
+        "CONFIG_STD_CPP17=y",
+        "CONFIG_TENSORFLOW_LITE_MICRO=y",
+        "CONFIG_ALP_SDK_INFERENCE_BACKEND_TFLM=y",
+    ]
+
+    # ---- G-2 -- CPU-class TFLM kernel selector --------------------
+    # Look up this slice's core in the SoC spec; pick exactly one of
+    # NEON / HELIUM / REF based on the vector_extension field.  Defaults
+    # to REF when the SoC JSON is silent (paper-correct on the scalar
+    # M33s -- V2N m33_sm).
+    #
+    # `c.get("type")` is UNVALIDATED against `soc-spec-v1.schema.json`'s own
+    # `"type": {"type": "string"}` -- the identical gap `presets_cmd.
+    # core_type_lookup` and `topology.core_os_topology` closed for
+    # tan-cli#957, same class, this call site missed by that sweep
+    # (tan-cli#962): a schema-invalid SoC JSON (hand-authored, mid-
+    # `porting-a-new-som`, or corrupted) with a truthy non-string `type`
+    # reaches `.lower()` here and raises `AttributeError`, aborting `tan
+    # build` for the whole slice on any board that reaches this branch
+    # (`_slice_wants_inference` -- examples/ai, examples/audio,
+    # examples/camera-vision). `isinstance`-guard to the same `""`
+    # unresolved sentinel a missing `type` already produces, matching
+    # `core_type_lookup`'s `c["type"] if isinstance(c.get("type"), str)
+    # else ""`.
+    tflm_kernel_kc: str = "CONFIG_ALP_SDK_INFERENCE_TFLM_KERNEL_REF=y"
+    for c in (project.soc_spec.get("cores") or []):
+        if c.get("id") != slice_.core_id:
+            continue
+        raw_vec = c.get("vector_extension")
+        vec = raw_vec.lower() if isinstance(raw_vec, str) else ""
+        raw_type = c.get("type")
+        ctype = raw_type.lower() if isinstance(raw_type, str) else ""
+        if vec == "neon" or ctype.startswith("cortex-a"):
+            tflm_kernel_kc = "CONFIG_ALP_SDK_INFERENCE_TFLM_KERNEL_NEON=y"
+        elif vec == "helium":
+            tflm_kernel_kc = "CONFIG_ALP_SDK_INFERENCE_TFLM_KERNEL_HELIUM=y"
+        else:
+            tflm_kernel_kc = "CONFIG_ALP_SDK_INFERENCE_TFLM_KERNEL_REF=y"
+        break
+    inference_lines.append(tflm_kernel_kc)
+
+    # ---- G-1 -- per-variant Ethos-U selector ---------------------
+    # Which Ethos-U variants this SoM carries -- derived from the
+    # silicon-determined capability counts (ethos_u{55,85}_count, resolved
+    # from the SoC JSON npus[] via resolve_capabilities).  This is the single
+    # source: an on-die NPU cannot be depopulated at the SoM level, so the SoM
+    # preset does NOT restate the variant list.
+    ethos_variants: set[str] = set()
+    if (capabilities.get("ethos_u55_count") or 0) > 0:
+        ethos_variants.add("u55")
+    if (capabilities.get("ethos_u85_count") or 0) > 0:
+        ethos_variants.add("u85")
+    ethos_present = bool(ethos_variants)
+    if ethos_present:
+        # Per-silicon Ethos-U backend (Slice 3 registry layout):
+        # Alif Ensemble (AEN) -> _BACKEND_ETHOS_U_AEN
+        # Parent-gating (#874 item 3): the variant switches `depend on` the
+        # parent backend (zephyr/kconfigs/iot-audio-inference.kconfig).
+        inference_lines.append("CONFIG_ALP_SDK_INFERENCE_BACKEND_ETHOS_U_AEN=y")
+        allowed_variants = {"u55", "u85"}
+        for v in sorted(ethos_variants & allowed_variants):
+            inference_lines.append(f"CONFIG_ALP_SDK_INFERENCE_ETHOS_U_VARIANT_{v.upper()}=y")
+        # Real Arm Ethos-U driver config -- the silicon-proven pair (bench:
+        # E1M-AEN801/E8, person_detect U85).  BACKEND_ETHOS_U_AEN already
+        # `select ETHOS_U if DT_HAS_ARM_ETHOS_U_ENABLED` (silicon-only); these
+        # assignments complete the driver config.  The core driver compiles
+        # exactly ONE accelerator config (ETHOS_U_NPU_CONFIG is a Kconfig
+        # `choice`), so pick the single most-capable NPU this silicon carries.
+        # On native_sim (no arm,ethos-u node) ETHOS_U stays off, so the
+        # ETHOS_U*-dependent lines below no-op with a harmless Kconfig
+        # "assigned y but got n" warning (same pattern as TENSORFLOW_LITE_MICRO
+        # above).  CONFIG_ETHOS_U_DCACHE=y links the correct-signature dcache
+        # hooks (NOT CONFIG_ARM_ETHOS_U -- hal_alif's stale callback path);
+        # CONFIG_DCACHE=n is the CPU<->NPU SRAM coherence mechanism; the
+        # ethos_u driver's mutex/semaphore need a kernel heap (k_malloc).
+        # Pick the most-capable variant this silicon carries (U85 > U55),
+        # then read its MAC config from the SoC's npus[] `mac_per_cycle` -- NOT a
+        # hardcode.  The derived symbol must be a real ETHOS_U_NPU_CONFIG choice
+        # member (hal_ethos_u), else it would silently no-op -- so validate and
+        # fail loudly on a metadata mismatch.
+        if "u85" in ethos_variants:
+            variant_num = "85"
+        else:
+            variant_num = "55"
+        npu_type = f"ethos-u{variant_num}"
+        npus_of_type = [
+            n for n in (project.soc_spec.get("npus") or [])
+            if str(n.get("type", "")).lower() == npu_type and n.get("mac_per_cycle")
+        ]
+        # Size the accelerator for the NPU instance THIS slice's core actually
+        # drives, not the SoC's most-capable one.  A part can carry two U55s of
+        # the same variant but different MACs wired to different cores (E3/E5/E7:
+        # a 256-MAC high-perf U55 on M55-HP + a 128-MAC high-efficiency U55 on
+        # M55-HE -- npus[].paired_core in the SoC JSON).  A 256-MAC command
+        # stream errors a 128-MAC NPU at invoke (register-proven on E8), so a
+        # blind max() would mis-size the HE slice.  Prefer the core-paired
+        # instance; fall back to the most-capable of the variant when the chosen
+        # variant is not core-paired (the E8 U85, a shared SoC-level NPU --
+        # Alif block name NPU_HG) or the SoC JSON predates paired_core.
+        paired = [n["mac_per_cycle"] for n in npus_of_type
+                  if n.get("paired_core") == slice_.core_id]
+        macs   = [n["mac_per_cycle"] for n in npus_of_type]
+        if paired:
+            mac = paired[0]
+        elif len({*macs}) > 1:
+            # This variant has >1 distinct MAC array on the SoC but none is
+            # paired_core=<this slice's core> -- a silent max() here would
+            # re-introduce the #909 mis-sizing (a 256-MAC command stream errors
+            # a 128-MAC NPU at invoke).  Fail loudly, like the _valid_accel
+            # guard below, so a missing/typo'd paired_core is caught at emit.
+            raise ValueError(
+                f"{silicon}: inference slice core {slice_.core_id!r} drives an "
+                f"{npu_type} but the SoC JSON declares MAC variants {sorted({*macs})} "
+                f"and none sets paired_core={slice_.core_id!r} -- add "
+                f"npus[].paired_core so the build sizes the accelerator for this "
+                f"core instead of guessing (see #909).")
+        else:
+            # Single MAC for this variant (or npus[]-less older spec): unambiguous.
+            mac = macs[0] if macs else 256
+        accel = f"ETHOS_U{variant_num}_{mac}"
+        _valid_accel = {
+            "ETHOS_U55_64", "ETHOS_U55_128", "ETHOS_U55_256",
+            "ETHOS_U85_128", "ETHOS_U85_256", "ETHOS_U85_512",
+            "ETHOS_U85_1024", "ETHOS_U85_2048",
+        }
+        if accel not in _valid_accel:
+            raise ValueError(
+                f"{silicon}: derived Ethos-U accelerator {accel!r} "
+                f"(npus[].mac_per_cycle={mac} for {npu_type}) is not a valid "
+                f"ETHOS_U_NPU_CONFIG choice member -- check the SoC JSON npus[]")
+        inference_lines.append("CONFIG_ETHOS_U_DCACHE=y")
+        inference_lines.append(f"CONFIG_{accel}=y")
+        inference_lines.append("CONFIG_DCACHE=n")
+        inference_lines.append("CONFIG_HEAP_MEM_POOL_SIZE=65536")
+    # DRP-AI3 and DEEPX DX-M1 have NO Zephyr Kconfig -- deliberately.
+    # Both engines are A55/Linux-side only (DRP-AI3 via the MERA/TVM
+    # userspace runtime, DX-M1 via libdxrt over the A55's PCIe); an
+    # M-class Zephyr slice cannot drive either (issues #58/#59), so it
+    # gets TFLM only.  Their build wiring lives on the cmake-args /
+    # Yocto emit paths (_slice_cmake_args below).
+    # SoM-declared AUTO accelerator order for the .alpmodel tiebreak
+    # (zephyr/CMakeLists.txt maps it to -DALP_SDK_INFERENCE_AUTO_ORDER, the
+    # same define name the Yocto and baremetal builds use).
+    auto_order = _inference_auto_order(project.som_preset)
+    if auto_order:
+        inference_lines.append(
+            f'CONFIG_ALP_SDK_INFERENCE_AUTO_ORDER="{",".join(auto_order)}"')
+    lines.append("# Inference dispatchers (from SoM capabilities -- "
+                 "customer does not pick)")
+    lines.extend(inference_lines)
+    lines.append("")
+    return lines
+
+
+def _emit_cross_core_shmem_cache(
+    project: "BoardProject",
+    slice_: Slice,
+    existing_lines: list[str],
+) -> list[str]:
+    """CONFIG_DCACHE=n for a slice sharing a non-cacheable `raw_shmem` or
+    `rpmsg` IPC carve-out with a peer core -- the hardware fact this symbol
+    encodes (each core has its own D-cache; shared SRAM is cross-core
+    incoherent unless the cache is off, or the app does explicit cache
+    maintenance) is NOT specific to Ethos-U inference.  Before this, the
+    only place that emitted it was the Ethos-U branch of `_emit_inference`,
+    so a non-inference cross-core project (e.g. `examples/multicore/
+    mproc-mailbox`, an M55-HP<->M55-HE mailbox+shmem roundtrip with no
+    `inference:` block) got no help from the generator and had to
+    hand-write the line in `prj.conf` -- see alp-sdk PR #1080, which found
+    three examples silently reporting `RESULT SKIP` while the debug AP
+    watched their beacons advance: the hardware worked, the stale D-cache
+    just hid it from the software.
+
+    Board-agnostic and keyed off the existing `ipc:` schema field (board-
+    yaml §3.9), not a SoC/vendor check, so it fires for any silicon that
+    declares a matching carve-out:
+
+      - `kind: rpmsg` is covered too (alp-sdk #1088's conservative fix),
+        for the identical reason `raw_shmem` is: `<alp/rpc.h>` has no
+        cache-maintenance layer (no `sys_cache_*` call anywhere under
+        `src/` or `include/`, and no per-channel cache field).  A
+        `cacheable: true` rpmsg channel would therefore select a path with
+        no maintenance behind it, so
+        `loader.py` rejects `cacheable: true` on a `rpmsg` entry outright
+        rather than silently honouring it -- any entry that reaches this
+        function is already non-cacheable, and the D-cache goes off
+        unconditionally for its endpoints.  The real fix --
+        `sys_cache_data_flush_range` / `sys_cache_data_invd_range` in
+        `<alp/rpc.h>` -- remains open; see alp-sdk #1088.
+      - `kind: mailbox_only` is excluded -- it carries no shared memory
+        (doorbell + signal only), so there is nothing to keep coherent.
+      - `kind: raw_shmem` closes the original #1080 case: `<alp/mproc.h>`'s
+        raw shmem+mailbox primitives have no cache-maintenance layer
+        either, so the SDK's zero-effort-safe default is to turn the
+        D-cache off for every endpoint -- unless the entry opts out with
+        an explicit `cacheable: true`, which is the app declaring it will
+        do its own cache ops instead (board.schema.json
+        `ipc_entry.cacheable`).  This opt-out is `raw_shmem`-only; `rpmsg`
+        has no opt-out (see above).
+
+    Must run after `_emit_inference` in `_slice_alp_conf` (the dedup below
+    depends on that order, it does not detect the reverse case): skips
+    emission if a line asserting the same symbol is already present, i.e.
+    the Ethos-U inference branch already asserted it for this slice --
+    kept as its own check rather than threading a bool out of
+    `_emit_inference`, since the two triggers (Ethos-U NPU coherence vs.
+    mproc shmem coherence) are unrelated hardware facts that happen to
+    share one Kconfig symbol.
+    """
+    if any("CONFIG_DCACHE=n" in line for line in existing_lines):
+        return []
+    needs_dcache_off = any(
+        entry.kind in ("raw_shmem", "rpmsg")
+        and slice_.core_id in entry.endpoints
+        and not entry.cacheable
+        for entry in project.ipc
+    )
+    if not needs_dcache_off:
+        return []
+    return [
+        "# board.yaml ipc[].kind: raw_shmem or rpmsg names this core as",
+        "# an endpoint with no explicit cacheable: true opt-out.",
+        "# <alp/mproc.h> (raw_shmem) and <alp/rpc.h> (rpmsg) both have no",
+        "# cache-maintenance layer, so the D-cache must stay off (not",
+        "# just the carve-out's own region) for both sides to see each",
+        "# other's writes without explicit clean/invalidate (PR #1080,",
+        "# #1088).",
+        "CONFIG_DCACHE=n",
+        "",
+    ]
+
+
+def _emit_memory(slice_: Slice) -> list[str]:
+    """Per-slice memory tuning (board.yaml `cores.<id>.memory:`)."""
+    lines: list[str] = []
+    mem = slice_.memory or {}
+    mem_lines: list[str] = []
+    if mem.get("stack_kib"):
+        mem_lines.append(f"CONFIG_MAIN_STACK_SIZE={int(mem['stack_kib']) * 1024}")
+    if mem.get("isr_stack_kib"):
+        mem_lines.append(f"CONFIG_ISR_STACK_SIZE={int(mem['isr_stack_kib']) * 1024}")
+    if mem.get("heap_kib") is not None:
+        mem_lines.append(f"CONFIG_HEAP_MEM_POOL_SIZE={int(mem['heap_kib']) * 1024}")
+    if mem_lines:
+        lines.append("# Per-slice memory tuning (board.yaml cores.<id>.memory:)")
+        lines.extend(mem_lines)
+        lines.append("")
+    return lines
+
+
+def _emit_power(slice_: Slice) -> list[str]:
+    """Per-slice power-management profile (board.yaml `cores.<id>.power:`)."""
+    lines: list[str] = []
+    pwr = slice_.power or {}
+    pwr_lines: list[str] = []
+    sleep_mode = (pwr.get("sleep_mode") or "disabled").lower()
+    if sleep_mode != "disabled":
+        pwr_lines.append("CONFIG_PM=y")
+        pwr_lines.append("CONFIG_PM_DEVICE=y")
+        # PM_STATE_* selection is silicon-family-specific; lowest-power
+        # state the hierarchy keeps is mirrored in a single hint flag.
+        pwr_lines.append(f"# Sleep target: {sleep_mode}")
+    for wake in (pwr.get("wakeup_sources") or []):
+        # Wake-source declarations land as hint comments only.  Zephyr
+        # marks a device as wakeup-capable via the DT `wakeup-source;`
+        # property + a runtime pm_device_wakeup_enable() call; there is
+        # no top-level CONFIG_PM_DEVICE_WAKE_<SUBSYS> Kconfig symbol, so
+        # emitting one trips the build with `undefined symbol` warnings
+        # (-> kconfig errors -> twister CMake build failure).  The real
+        # DT-overlay + runtime-enable plumbing lands per silicon in v0.7;
+        # until then the wake-source list is documented in the generated
+        # alp.conf for the customer to wire by hand.
+        if isinstance(wake, str) and not wake.startswith("E1M_"):
+            pwr_lines.append(
+                f"# wakeup source: {wake} "
+                "(DT wakeup-source; + pm_device_wakeup_enable() pending v0.7)")
+        elif isinstance(wake, str):
+            pwr_lines.append(f"# wakeup source: {wake} (per-silicon Kconfig pending)")
+    if pwr_lines:
+        lines.append("# Per-slice power-management profile (board.yaml cores.<id>.power:)")
+        lines.extend(pwr_lines)
+        lines.append("")
+    return lines
+
+
+def _emit_storage(project: "BoardProject") -> list[str]:
+    """Storage partitions (board.yaml `storage:` block).  Emits per-fs
+    Kconfig for every resolved (non-blocked) partition.  Blocked
+    partitions produce a hint comment so the slice build still
+    compiles but the runtime mount fails loudly via the DTS overlay.
+
+    Per-slice ownership of partitions is not modelled today: every
+    Zephyr/baremetal slice gets the union.  Kconfig dedupes when
+    multiple per-core fragments overlay onto the same base.  v0.7
+    may add `core:` to storage entries for per-slice scoping.
+    """
+    lines: list[str] = []
+    partitions = resolve_storage_partitions(project)
+    ok_partitions = [p for p in partitions if p.status == "ok"]
+    fs_seen: set[str] = set()
+    for p in ok_partitions:
+        fs_seen.add(p.fs)
+    fs_kconfig: list[str] = []
+    if "littlefs" in fs_seen:
+        fs_kconfig.append("CONFIG_FILE_SYSTEM=y")
+        fs_kconfig.append("CONFIG_FILE_SYSTEM_LITTLEFS=y")
+    if "fat" in fs_seen:
+        fs_kconfig.append("CONFIG_FILE_SYSTEM=y")
+        fs_kconfig.append("CONFIG_FAT_FILESYSTEM_ELM=y")
+    if "ext4" in fs_seen:
+        fs_kconfig.append("CONFIG_FILE_SYSTEM=y")
+        fs_kconfig.append("CONFIG_FILE_SYSTEM_EXT2=y")
+    if fs_kconfig or ok_partitions:
+        lines.append("# Storage partitions (board.yaml `storage:`)")
+        # FILE_SYSTEM=y appears twice in the list when multiple fs
+        # types are enabled; dedupe before emit.
+        for kc in sorted(set(fs_kconfig)):
+            lines.append(kc)
+        # Per-partition LITTLEFS partition labels surface as a hint
+        # comment only.  Modern Zephyr does NOT define a per-partition
+        # CONFIG_FS_LITTLEFS_PARTITION_<NAME> Kconfig -- the partition
+        # gets matched via the DT `fixed-partitions` node + the
+        # chosen `zephyr,storage-partition` / FIXED_PARTITION_ID()
+        # macro at runtime.  Emitting a Kconfig stem trips Zephyr's
+        # "assignment to undefined symbol" warning + aborts the build.
+        for p in ok_partitions:
+            if p.fs == "littlefs":
+                lines.append(
+                    f"# partition[{p.name}] -> mount at runtime via "
+                    f"FIXED_PARTITION_ID({p.name}_partition)")
+        blocked = [p for p in partitions if p.status == "blocked"]
+        for p in blocked:
+            lines.append(f"# BLOCKED storage[{p.name}]: "
+                         f"{p.reason or 'unknown reason'}")
+        lines.append("")
+    return lines
+
+
+def _split_server_url(url: str) -> tuple[str, Optional[int], Optional[str]]:
+    """Decompose an `ota.server.url` into (host, port, scheme).
+
+    board.yaml's `ota.server.url` is a full URI (`board.schema.json` types it
+    `format: uri`).  Zephyr's Hawkbit client wants the three parts SEPARATELY
+    -- a bare host for `zsock_getaddrinfo()` / the TLS SNI name / the HTTP
+    `Host:` header, an int port, and a TLS bool.  Handing it the whole URI is
+    a DNS lookup that can never resolve (alplabai/tan-cli#558).
+
+    A value carrying no `://` is taken as an already-bare host and returned
+    verbatim.  A `${VAR}` placeholder passes through here too, but
+    `_slice_alp_conf` then refuses it: nothing substitutes a placeholder in a
+    Kconfig fragment (issue #2696, `_refuse_live_kconfig_placeholders`).  Host
+    case is preserved (DNS is case-insensitive), so this parses the authority
+    by hand rather than through `urlsplit`, whose `.hostname` lowercases.
+
+    Raises OrchestratorError on anything that cannot be expressed as those
+    three parts rather than emitting a value the client cannot use.
+    """
+    raw = url.strip()
+    if "://" not in raw:
+        return raw, None, None
+    scheme, _, rest = raw.partition("://")
+    scheme = scheme.lower()
+    if scheme not in ("http", "https"):
+        raise OrchestratorError(
+            f"ota.server.url `{url}`: scheme `{scheme}` is not supported by "
+            f"the Zephyr Hawkbit DDI client -- use http:// or https://")
+    authority, sep, path = rest.partition("/")
+    if sep and path not in ("", "/"):
+        raise OrchestratorError(
+            f"ota.server.url `{url}`: the Hawkbit DDI client builds its own "
+            f"request paths (/{{tenant}}/controller/v1/...) and has no knob "
+            f"for a base path, so `/{path}` cannot be honoured -- give the "
+            f"scheme, host and port only")
+    if "@" in authority:
+        raise OrchestratorError(
+            f"ota.server.url `{url}`: userinfo in the URL is not supported -- "
+            f"Hawkbit authenticates with a DDI security token "
+            f"(`ota.server.tenant`), not URL credentials")
+    port: Optional[int] = None
+    host = authority
+    if authority.startswith("["):          # bracketed IPv6 literal
+        close = authority.find("]")
+        if close < 0:
+            raise OrchestratorError(
+                f"ota.server.url `{url}`: unterminated IPv6 literal in the host")
+        host = authority[:close + 1]
+        tail = authority[close + 1:]
+        if tail.startswith(":"):
+            port_text = tail[1:]
+        elif tail:
+            raise OrchestratorError(
+                f"ota.server.url `{url}`: unexpected `{tail}` after the "
+                f"IPv6 host literal")
+        else:
+            port_text = ""
+    else:
+        host, _, port_text = authority.partition(":")
+    if port_text:
+        if not port_text.isdigit() or not 1 <= int(port_text) <= 65535:
+            raise OrchestratorError(
+                f"ota.server.url `{url}`: `{port_text}` is not a valid TCP port")
+        port = int(port_text)
+    if not host:
+        raise OrchestratorError(
+            f"ota.server.url `{url}`: no host to resolve")
+    if port is None:
+        port = 443 if scheme == "https" else 80
+    return host, port, scheme
+
+
+def _hawkbit_server_lines(url: str) -> list[str]:
+    """`CONFIG_HAWKBIT_{SERVER,PORT,USE_TLS}` for one `ota.server.url`.
+
+    Grounded in the pinned Zephyr v4.4.1 tree:
+      * `HAWKBIT_SERVER` -- "User address for the hawkbit server"
+        (subsys/mgmt/hawkbit/Kconfig:68): bare host, fed to
+        `zsock_getaddrinfo()`, the TLS hostname and the `Host:` header.
+      * `HAWKBIT_PORT` -- int, `default 8080` (Kconfig:75).
+      * `HAWKBIT_USE_TLS` -- `depends on NET_SOCKETS_SOCKOPT_TLS`
+        (Kconfig:168), so the socket option has to be enabled alongside it
+        or kconfiglib warns "assigned y but got n" and the Zephyr configure
+        aborts.
+    """
+    host, port, scheme = _split_server_url(url)
+    lines = [f'CONFIG_HAWKBIT_SERVER="{host}"']
+    if port is not None:
+        lines.append(f"CONFIG_HAWKBIT_PORT={port}")
+    if scheme == "https":
+        lines.append("CONFIG_NET_SOCKETS_SOCKOPT_TLS=y")
+        lines.append("CONFIG_HAWKBIT_USE_TLS=y")
+    elif scheme is None:
+        lines.append("# ota.server.url carries no scheme -- taken as a bare "
+                     "host; CONFIG_HAWKBIT_PORT / CONFIG_HAWKBIT_USE_TLS keep "
+                     "their Zephyr defaults (8080, plaintext).")
+    return lines
+
+
+# Zephyr's CONFIG_HAWKBIT_POLL_INTERVAL is declared in MINUTES with
+# `range 1 43200` (subsys/mgmt/hawkbit/Kconfig:29-33) and is multiplied by
+# SEC_PER_MIN at runtime (subsys/mgmt/hawkbit/hawkbit.c:57).
+_HAWKBIT_POLL_MIN_MINUTES = 1
+_HAWKBIT_POLL_MAX_MINUTES = 43200
+
+
+def _hawkbit_poll_line(poll_s: int) -> str:
+    """`CONFIG_HAWKBIT_POLL_INTERVAL` for one `ota.poll_interval_s`.
+
+    board.yaml states the interval in SECONDS; the Kconfig symbol is in
+    MINUTES.  Writing the seconds value through verbatim dilated every fleet's
+    poll period 60x -- the schema's own 1800 s default became 1800 minutes =
+    30 hours (alplabai/tan-cli#557).  Convert, and refuse a value that cannot
+    be expressed in whole minutes or that falls outside Zephyr's declared
+    range, rather than emitting an out-of-range value the Zephyr configure
+    will abort on (or, with the abort relaxed, silently replace with the
+    default of 5).
+    """
+    minutes, remainder = divmod(poll_s, 60)
+    if remainder:
+        raise OrchestratorError(
+            f"ota.poll_interval_s: {poll_s} s cannot be expressed in "
+            f"CONFIG_HAWKBIT_POLL_INTERVAL, which Zephyr declares in whole "
+            f"MINUTES -- use {minutes * 60} or {(minutes + 1) * 60}")
+    if not _HAWKBIT_POLL_MIN_MINUTES <= minutes <= _HAWKBIT_POLL_MAX_MINUTES:
+        raise OrchestratorError(
+            f"ota.poll_interval_s: {poll_s} s is {minutes} min, outside "
+            f"CONFIG_HAWKBIT_POLL_INTERVAL's `range "
+            f"{_HAWKBIT_POLL_MIN_MINUTES} {_HAWKBIT_POLL_MAX_MINUTES}` "
+            f"(minutes) -- use {_HAWKBIT_POLL_MIN_MINUTES * 60} .. "
+            f"{_HAWKBIT_POLL_MAX_MINUTES * 60} s")
+    return f"CONFIG_HAWKBIT_POLL_INTERVAL={minutes}"
+
+
+def _emit_ota(project: "BoardProject") -> list[str]:
+    """OTA Zephyr client (board.yaml `ota:` block, provider-driven dispatch).
+
+    Resolved design Q on the Zephyr-side OTA client (ADR 0009 follow-up):
+      provider: mender   -> Mender-MCU-client (out-of-tree, BSD-3)
+      provider: hawkbit  -> Zephyr Hawkbit DDI client (upstream)
+      provider: mcumgr   -> Zephyr MCUmgr (upstream; transport is the app's call)
+
+    Yocto slices keep the existing Mender server-mode dispatch in
+    `_slice_local_conf`.  This handles the Zephyr side: per-slice
+    Kconfig that compiles the matching client in.  Settings (server URL,
+    poll interval, tenant token) thread through Kconfig string values
+    when declared in `ota:`.  A `${VAR}` placeholder may only land on a
+    commented line here (the Mender hints): Zephyr does not expand one in a
+    Kconfig fragment, so `_slice_alp_conf` refuses it on a live line
+    (issue #2696).
+    """
+    lines: list[str] = []
+    ota = project.ota or {}
+    provider = (ota.get("provider") or "").lower() if isinstance(ota, dict) else ""
+    if provider and provider in ("mender", "hawkbit", "mcumgr"):
+        lines.append(f"# OTA Zephyr client (board.yaml `ota.provider: {provider}`)")
+        srv = (ota.get("server") or {}) if isinstance(ota.get("server"), dict) else {}
+        poll = ota.get("poll_interval_s")
+        if provider == "mender":
+            # Mender-MCU-client.  The west.yml `mender` group is NOT
+            # active by default (the upstream mender-mcu-client
+            # repository is pinned alongside the v0.7 OTA wiring), so
+            # CONFIG_MENDER_* would resolve to undefined-symbol warnings
+            # under twister and abort the build.  Emit the settings as
+            # hint comments so the configuration is visible to the
+            # customer (and to anyone reviewing the generated alp.conf)
+            # while keeping the build clean.  When the mender west
+            # group flips active the comments here go back to live
+            # CONFIG_* lines in a single commit.
+            lines.append("# Mender-MCU-client wiring is pending the v0.7 OTA module")
+            lines.append("# (mender-mcu-client west group activation).")
+            lines.append("# CONFIG_MENDER_MCU_CLIENT=y")
+            if srv.get("url"):
+                lines.append(f'# CONFIG_MENDER_SERVER_URL="{srv["url"]}"')
+            if srv.get("tenant"):
+                lines.append(f'# CONFIG_MENDER_TENANT_TOKEN="{srv["tenant"]}"')
+            if ota.get("artifact_name"):
+                lines.append(f'# CONFIG_MENDER_ARTIFACT_NAME="{ota["artifact_name"]}"')
+            if isinstance(poll, int) and poll > 0:
+                lines.append(f"# CONFIG_MENDER_UPDATE_POLL_INTERVAL={poll}")
+        elif provider == "hawkbit":
+            # Zephyr upstream's Hawkbit DDI client.
+            lines.append("CONFIG_HAWKBIT=y")
+            lines.append("CONFIG_HAWKBIT_SHELL=y")
+            if srv.get("url"):
+                lines.extend(_hawkbit_server_lines(str(srv["url"])))
+            if isinstance(poll, int) and poll > 0:
+                lines.append(_hawkbit_poll_line(poll))
+        elif provider == "mcumgr":
+            # MCUmgr is upstream; the transport (UART/BLE/UDP) stays the
+            # app's call -- we only enable the base SMP server.
+            lines.append("CONFIG_MCUMGR=y")
+            lines.append("CONFIG_MCUMGR_GRP_IMG=y")
+            lines.append("CONFIG_MCUMGR_GRP_OS=y")
+            lines.append("# MCUmgr transport (UART/BLE/UDP) is the app's call;")
+            lines.append("# enable the matching CONFIG_MCUMGR_TRANSPORT_* in your prj.conf.")
+        lines.append("")
+    return lines
+
+
+# board.yaml `diagnostics.modules:` level -> the Zephyr log-choice suffix.
+# Zephyr's per-module choice is <MOD>_LOG_LEVEL_{OFF,ERR,WRN,INF,DBG,DEFAULT}
+# (subsys/logging/Kconfig.template.log_config); the int <MOD>_LOG_LEVEL is
+# PROMPTLESS and derived from that choice, so it cannot be assigned from a
+# fragment at all.  Zephyr has no TRACE level -- `trace` maps to DBG, the same
+# value 4 the old int emit used.
+_LOG_LEVEL_CHOICE = {
+    "off":   "OFF",
+    "error": "ERR",
+    "warn":  "WRN",
+    "info":  "INF",
+    "debug": "DBG",
+    "trace": "DBG",
+}
+
+# board.yaml `diagnostics.modules:` key -> (Zephyr log-module name, the
+# Kconfig symbol(s) whose `=y` proves the choice symbol is DECLARED -- one
+# name, or a tuple when the declaration is nested in more than one `if` --,
+# the symbol the module's log choice `depends on`).
+#
+# All three are load-bearing.  A module's `<MOD>_LOG_LEVEL_<LEVEL>` choice
+# symbols exist only inside the `if` block(s) enclosing the module's
+# `source "...Kconfig.template.log_config"`, and the choice itself
+# `depends on` a logging gate -- plain `LOG` for the subsys/logging template,
+# `NET_LOG` for the networking one
+# (subsys/net/Kconfig.template.log_config.net: `depends on $(module-dep)`).
+# Both failure modes are real, and they are NOT the same failure:
+#
+#   * assigning an UNDEFINED symbol is fatal -- alp.conf is loaded as a
+#     handwritten fragment with `warn_assign_undef=True` and
+#     `zephyr/scripts/kconfig/kconfig.py` turns that warning into
+#     `err("Aborting due to Kconfig warnings")`;
+#   * assigning a DEFINED-but-undeclared-here choice symbol is SILENT -- the
+#     configure still exits 0, the override is discarded, and all you get is
+#     `warning: The choice symbol <SYM> ... was selected (set =y), but no
+#     symbol ended up as the choice selection`.  Measured on real Zephyr
+#     v4.4.1 (`cmake -DBOARD=native_sim samples/hello_world` + a fragment
+#     carrying CONFIG_LOG=y / CONFIG_MBEDTLS=y / CONFIG_MBEDTLS_LOG_LEVEL_DBG=y:
+#     EXIT=0, and the generated .config has no CONFIG_MBEDTLS_LOG_LEVEL_DBG
+#     line at all).  That silent branch is exactly what tan-cli#559 is about,
+#     so the guard columns below have to be EXACT, not approximately right.
+#
+# So a line goes live only when EVERY guard symbol AND the logging gate are
+# already `=y` in this very fragment.
+#
+# Every entry below is transcribed from the pinned Zephyr v4.4.1 tree -- the
+# module name appears there as a literal `module = <NAME>` feeding a
+# log_config template, and each guard symbol is a real `config`/`menuconfig`
+# this emitter can put in the fragment.  The guard column is the enclosing
+# `if` chain resolved across the whole `source` chain from Kconfig.zephyr
+# down, minus the parts a guard already implies (e.g. `if NETWORKING` around
+# every net_* row is implied by `NET_LOG`, which is declared inside it; the
+# hidden `BT_LOG` is `default y if LOG && BT`; `FILE_SYSTEM_LIB_LINK` is
+# `select`ed by `FILE_SYSTEM`).
+#
+# Two residual `if`s cannot be expressed here because they are NEGATIVE and
+# the guard set only knows `=y`: `if !NET_RAW_MODE` (hidden, default n, only
+# `select`ed by the IEEE-802.15.4 raw drivers) around net_core / net_tcp /
+# net_ipv4, and the `BT_STACK_SELECTION` choice defaulting to `BT_HCI` around
+# bluetooth.  A board that selects `NET_RAW_MODE` or `BT_CUSTOM` would get the
+# silent-discard branch above; the SDK enables neither.
+#
+# A key that is not in this table (a typo, or a real Zephyr module the SDK
+# never enables) degrades to a comment; that is the safe direction -- a
+# missing entry costs a log-level override, a wrong entry costs the override
+# silently and leaves a Kconfig warning in the build.
+_LOG_MODULES: dict[str, tuple[str, str | tuple[str, ...], str]] = {
+    # drivers/ -- subsys/logging/Kconfig.template.log_config (`depends on LOG`)
+    "adc":             ("ADC", "ADC", "LOG"),                    # drivers/adc/Kconfig:94
+    "can":             ("CAN", "CAN", "LOG"),                    # drivers/can/Kconfig:16
+    "counter":         ("COUNTER", "COUNTER", "LOG"),            # drivers/counter/Kconfig:47
+    "dac":             ("DAC", "DAC", "LOG"),                    # drivers/dac/Kconfig:16
+    "display":         ("DISPLAY", "DISPLAY", "LOG"),            # drivers/display/Kconfig:19
+    "ethernet":        ("ETHERNET", "ETH_DRIVER", "LOG"),        # drivers/ethernet/Kconfig:23 (enable :6)
+    "flash":           ("FLASH", "FLASH", "LOG"),                # drivers/flash/Kconfig:226
+    "gpio":            ("GPIO", "GPIO", "LOG"),                  # drivers/gpio/Kconfig:13
+    "i2c":             ("I2C", "I2C", "LOG"),                    # drivers/i2c/Kconfig:188
+    "i2s":             ("I2S", "I2S", "LOG"),                    # drivers/i2s/Kconfig:22
+    "pwm":             ("PWM", "PWM", "LOG"),                    # drivers/pwm/Kconfig:13
+    "rtc":             ("RTC", "RTC", "LOG"),                    # drivers/rtc/Kconfig:11
+    "sensor":          ("SENSOR", "SENSOR", "LOG"),              # drivers/sensor/Kconfig:14
+    "spi":             ("SPI", "SPI", "LOG"),                    # drivers/spi/Kconfig:102
+    "uart_console":    ("UART_CONSOLE", "UART_CONSOLE", "LOG"),  # drivers/console/Kconfig:286
+    "watchdog":        ("WDT", "WATCHDOG", "LOG"),               # drivers/watchdog/Kconfig:43
+    "wifi":            ("WIFI", "WIFI", "LOG"),                  # drivers/wifi/Kconfig:11-12
+    # subsys/
+    "bluetooth":       ("BT", "BT", "LOG"),                      # subsys/bluetooth/Kconfig.logging:17
+    "fs":              ("FS", "FILE_SYSTEM", "LOG"),             # subsys/fs/Kconfig:144
+    "modbus":          ("MODBUS", "MODBUS", "LOG"),              # subsys/modbus/Kconfig:94
+    "pm":              ("PM", "PM", "LOG"),                      # subsys/pm/Kconfig:55
+    "pm_device":       ("PM_DEVICE", "PM_DEVICE", "LOG"),        # subsys/pm/Kconfig:118
+    "tls_credentials": ("TLS_CREDENTIALS", "TLS_CREDENTIALS", "LOG"),  # subsys/net/lib/tls_credentials/Kconfig:11
+    "usb_device":      ("USB_DEVICE", "USB_DEVICE_STACK", "LOG"),  # subsys/usb/device/Kconfig:16
+    # subsys/net -- Kconfig.template.log_config.net (`module-dep = NET_LOG`)
+    "coap":            ("COAP", "COAP", "NET_LOG"),              # subsys/net/lib/coap/Kconfig:286-287
+    "net_core":        ("NET_CORE", "NETWORKING", "NET_LOG"),    # subsys/net/ip/Kconfig.debug:48-49
+    # NET_NATIVE is load-bearing: the log_config sits inside `if
+    # NET_NATIVE_IPV4` (Kconfig.ipv4:44), a HIDDEN symbol -- `depends on
+    # NET_NATIVE`, `default y if NET_IPV4` (subsys/net/ip/Kconfig:60-63).  So
+    # NET_IPV4=y alone does NOT declare the choice on an offload-only
+    # (NET_NATIVE=n) target; NET_IPV4=y + NET_NATIVE=y does, exactly.
+    "net_ipv4":        ("NET_IPV4", ("NET_IPV4", "NET_NATIVE"), "NET_LOG"),  # subsys/net/ip/Kconfig.ipv4:191-192
+    "net_l2_ethernet": ("NET_L2_ETHERNET", "NET_L2_ETHERNET", "NET_LOG"),  # subsys/net/l2/ethernet/Kconfig:13-14
+    "net_sockets":     ("NET_SOCKETS", "NET_SOCKETS", "NET_LOG"),  # subsys/net/lib/sockets/Kconfig:443-444
+    "net_tcp":         ("NET_TCP", "NET_TCP", "NET_LOG"),        # subsys/net/ip/Kconfig.tcp:16-17
+    # modules/
+    # MBEDTLS_DEBUG is the real guard, not MBEDTLS: `module = MBEDTLS` sits
+    # inside `if MBEDTLS_DEBUG` (modules/mbedtls/Kconfig:89), itself nested in
+    # `if MBEDTLS` (:31).  MBEDTLS_DEBUG is a prompted bool defaulting n that
+    # this emitter never writes, while CONFIG_MBEDTLS=y IS written (from
+    # metadata/libraries/mbedtls.yaml) by iot-fleet-ota, production-deployment,
+    # rpmsg-v2n, rpmsg-aen and heterogeneous-offload -- so guarding on MBEDTLS
+    # alone made the ONE in-table module the SDK routinely enables emit a line
+    # whose choice symbol is not declared.
+    "mbedtls":         ("MBEDTLS", ("MBEDTLS", "MBEDTLS_DEBUG"), "LOG"),  # modules/mbedtls/Kconfig:89-93
+}
+
+
+def _enabled_symbols(lines: list[str]) -> set[str]:
+    """The Kconfig symbols this fragment has already switched on.
+
+    Reads back the `CONFIG_<SYM>=y` lines built so far (annotations like
+    `CONFIG_X=y  # lib / class` included), which is the only authority on what
+    this particular slice compiles in.
+    """
+    out: set[str] = set()
+    for line in lines:
+        text = line.strip()
+        if not text.startswith("CONFIG_") or "=" not in text:
+            continue
+        symbol, _, value = text.partition("=")
+        if value.split("#", 1)[0].strip() == "y":
+            out.add(symbol[len("CONFIG_"):])
+    return out
+
+
+def _emit_diagnostics(project: "BoardProject",
+                      slice_: Slice,
+                      emitted: list[str]) -> list[str]:
+    """Per-module log-level overrides (board.yaml `diagnostics.modules:`).
+
+    `board.schema.json` documents this knob as emitting
+    `CONFIG_<MODULE>_LOG_LEVEL_<LEVEL>=y` -- the choice-symbol form.  That is
+    what is emitted here.  The old `CONFIG_<MODULE>_LOG_LEVEL=<n>` int form
+    could not build for ANY key (alplabai/tan-cli#559): the int symbol is
+    promptless and derived, so Zephyr rejects assigning it even for a real
+    module (`I2C_LOG_LEVEL ... is not directly user-configurable (has no
+    prompt)`), and an unknown key was an assignment to an undefined symbol.
+
+    A live line is emitted only when the module is in `_LOG_MODULES` AND
+    EVERY one of its guard symbols AND its logging gate (`LOG`, or `NET_LOG`
+    for the networking modules) are already `=y` in `emitted` -- the
+    conditions under which the choice symbol is declared at all.  A module
+    can carry more than one guard when its log_config template is nested in
+    more than one `if`: `mbedtls` needs MBEDTLS **and** MBEDTLS_DEBUG,
+    `net_ipv4` needs NET_IPV4 **and** NET_NATIVE.  Getting that wrong is not
+    caught by the build: the configure still exits 0 and merely warns that
+    the choice symbol "was selected (set =y), but no symbol ended up as the
+    choice selection", so the override vanishes silently -- the same
+    silent-failure class tan-cli#559 is about.
+
+    Everything else (an ALP_* SDK module with no LOG_MODULE_REGISTER yet, a
+    module that lives on another core, a typo) is downgraded to a comment
+    naming the reason, so the fragment always configures.
+    """
+    lines: list[str] = []
+    modules = (project.diagnostics or {}).get("modules") or {}
+    if modules:
+        enabled = _enabled_symbols(emitted)
+        lines.append("# Per-module log-level overrides (board.yaml diagnostics.modules:)")
+        for mod, lvl in sorted(modules.items()):
+            choice = _LOG_LEVEL_CHOICE.get(str(lvl).lower())
+            if choice is None:
+                continue
+            known = _LOG_MODULES.get(str(mod).lower())
+            if known is None:
+                stem = str(mod).upper()
+                reason = (
+                    "pending LOG_MODULE_REGISTER on this SDK module"
+                    if stem.startswith("ALP_") else
+                    f"no Zephyr log module `{mod}` the SDK can wire -- "
+                    f"check the spelling")
+                lines.append(f"# CONFIG_{stem}_LOG_LEVEL_{choice}=y ({reason})")
+                continue
+            log_module, guard_symbols, log_gate = known
+            if isinstance(guard_symbols, str):
+                guard_symbols = (guard_symbols,)
+            symbol = f"CONFIG_{log_module}_LOG_LEVEL_{choice}"
+            missing = [g for g in guard_symbols if g not in enabled]
+            if log_gate not in enabled:
+                lines.append(f"# {symbol}=y (its log choice depends on "
+                             f"CONFIG_{log_gate}=y, not set on core "
+                             f"`{slice_.core_id}`)")
+            elif missing:
+                need = ", ".join(f"CONFIG_{g}=y" for g in missing)
+                lines.append(f"# {symbol}=y (its log choice is declared only "
+                             f"under {need}, not set on core "
+                             f"`{slice_.core_id}`)")
+            else:
+                lines.append(f"{symbol}=y")
+        lines.append("")
+    return lines
+
+
+def _slice_alp_conf(project: BoardProject, slice_: Slice) -> str:
+    """Per-core Kconfig fragment for a Zephyr slice.
+
+    Emits the full Kconfig the slice needs: baseline + log + silicon +
+    per-core peripherals/libraries + SoM-intrinsic chip drivers (auto-
+    derived from ``on_module:`` + ``helper_firmware:`` in the SoM preset)
+    + board-populated chip drivers (from board.yaml ``board.populated:``
+    + the board preset) + the Zephyr subsystem enables those chip drivers
+    need (e.g. an enabled ``rv3028c7`` chip driver pulls in ``CONFIG_I2C=y``).
+
+    Swapping ``som.sku:`` in board.yaml automatically changes the SoM-
+    intrinsic chip set with no other board.yaml edits required.
+
+    This is a thin composer: each section below is delegated to a
+    dedicated ``_emit_*`` helper (console / SoM capability / chip driver
+    / subsystem / library / inference / cross-core shmem cache / memory /
+    power / storage / OTA / diagnostics), called in the exact fixed order
+    the fragment has always used. Split out mechanically as the #673
+    Phase-1 kconfig split -- behavior-preserving for every section that
+    predates the cross-core shmem cache one; ``check_emit_snapshots.py``'s
+    fixtures (none of which declare a ``raw_shmem`` ``ipc:`` entry) stay
+    byte-identical.
+    """
+    silicon = project.som_preset.get("silicon")
+    kconfig = silicon_to_kconfig(silicon, project.effective_metadata_root())
+    diagnostics = project.diagnostics
+
+    lines: list[str] = []
+    lines.extend(_emit_baseline(slice_, diagnostics))
+    lines.extend(_emit_console(diagnostics, slice_, project))
+    lines.extend(_emit_soc_summary(project, slice_))
+    lines.extend(_emit_som_caps(project, silicon, kconfig))
+
+    chip_lines, chip_subsystems, resolved_chip_state = _emit_chips(
+        project, _CHIP_SUBSYSTEMS)
+    lines.extend(chip_lines)
+    lines.extend(_emit_subsystems(project, slice_, chip_subsystems))
+
+    iot_lines = _zephyr_iot_kconfig(project, slice_, resolved_chip_state)
+    if iot_lines:
+        lines.extend(iot_lines)
+
+    lines.extend(_emit_libraries(project, slice_))
+    # §D.lib.loader -- per-`libraries:` HW-accelerator backend wiring
+    # (CONFIG_ALP_<LIB>_<BACKEND>=y). This is the single source both the
+    # planner's build-plan `configArtefacts` and `alp_project.py --emit
+    # zephyr-conf --core <id>` (what gen_example_alp_conf.py's pre-generation
+    # for twister / bare `west build` mirrors) share
+    # -- folded in here (2026-07-20) so the two paths cannot silently
+    # diverge on a `libraries:` entry with a hw_backends matcher; see
+    # docs/adr/0020-sdk-owns-build-execution.md addendum.
+    #
+    # Reads BOTH declaration channels (`libraries.scoped_names`), not just
+    # `slice_.libraries`.  A library's accelerator support is a property of
+    # the library manifest and the SoM's silicon, not of whether board.yaml
+    # spelled the selection as a bare/project-wide entry or a `cores:`-
+    # scoped one -- the two forms must resolve to the identical hw-backend
+    # set for the same core (alp-sdk #1359: a `cores:` entry was silently a
+    # SUPERSET of the project-wide form, gaining HELIUM/ADC_DMA/etc. that
+    # `cores:` reads as narrowing, not widening).
+    hw_backend_lines = _library_layer._emit_library_hw_backends(
+        _library_layer.scoped_names(project, slice_=slice_), project.sku,
+        project.effective_metadata_root())
+    if hw_backend_lines:
+        lines.append("# §D.lib.loader -- per-library HW-accelerator "
+                     "wiring (auto-emitted).")
+        lines.extend(hw_backend_lines)
+        lines.append("")
+    lines.extend(_emit_inference(project, slice_, silicon))
+    lines.extend(_emit_cross_core_shmem_cache(project, slice_, lines))
+    lines.extend(_emit_memory(slice_))
+    lines.extend(_emit_power(slice_))
+    lines.extend(_emit_storage(project))
+    lines.extend(_emit_ota(project))
+    # Passed the fragment built so far: a per-module log-level override is
+    # only a real Kconfig symbol when THIS slice already switched the module
+    # (and CONFIG_LOG) on -- see `_emit_diagnostics`.
+    lines.extend(_emit_diagnostics(project, slice_, lines))
+    # Per-product core ownership: Kconfig for the assignable peripherals this
+    # project assigned to this (M33) core -- the board tree carries the nodes
+    # disabled, so only an owning project enables them.
+    own_kconfig = project_m33_overlay(project, slice_.core_id)[1]
+    if own_kconfig:
+        lines.append("# Assignable peripherals owned by this core (board.yaml "
+                     "`ownership:`).")
+        lines.extend(own_kconfig)
+
+    text = "\n".join(lines) + "\n"
+    _refuse_live_kconfig_placeholders(text, slice_.core_id)
+    return text
+
+
+def _refuse_live_kconfig_placeholders(text: str, core_id: str) -> None:
+    """Refuse a `${NAME}` placeholder on a live line of a Zephyr fragment.
+
+    A board.yaml value written as a placeholder (`ota.server.tenant:
+    "${MENDER_TENANT_TOKEN}"`) is meant for the build host or the device to
+    fill.  A Zephyr Kconfig fragment can never do that: the pinned v4.4.1
+    `scripts/kconfig/kconfiglib.py` `_load_config` only unescapes a `.conf`
+    string value -- the `expandvars` call in that file belongs to the Kconfig
+    *source* tokenizer, not the `.conf` loader -- and nothing in Zephyr's CMake
+    expands a fragment either.  So a live `CONFIG_HAWKBIT_SERVER="${HOST}"`
+    would build firmware that carries the literal text `${HOST}` as its
+    server name, silently.  A commented line (the Mender-MCU-client hint lines
+    in `_emit_ota`) is inert and allowed.
+    """
+    # Imported here, not at the top: a new top-of-file line would shift every
+    # line number that changelog fragments cite in this module.
+    import re
+
+    for line in text.splitlines():
+        if line.lstrip().startswith("#"):
+            continue
+        match = re.search(r"\$\{[^}]*\}", line)
+        if match:
+            raise OrchestratorError(
+                f"core '{core_id}': the Zephyr config would carry the "
+                f"placeholder `{match.group(0)}` literally (`{line.strip()}`) "
+                f"-- Zephyr does not expand environment variables in a "
+                f"Kconfig fragment, so the firmware would use the text "
+                f"`{match.group(0)}` itself.  Write the real value in "
+                f"board.yaml, or set it in the app's own prj.conf")
+
+
+def _inference_auto_order(som_preset: dict) -> list[str]:
+    """The SoM preset's ordered AUTO accelerator preference, best first.
+
+    `inference.auto_order` is the single source: its first entry is the SoM's
+    preferred backend.
+    """
+    return list((som_preset.get("inference") or {}).get("auto_order") or [])
+
+
+def _slice_local_conf(project: BoardProject, slice_: Slice) -> str:
+    """Per-core local.conf snippet for a Yocto slice."""
+    machine = slice_.machine or f"e1m-{project.sku.lower().replace('e1m-', '')}"
+    lines: list[str] = []
+    lines.append("# Auto-generated by scripts/alp_orchestrate.py "
+                 "-- append to local.conf.")
+    lines.append(f"# Per-core slice `{slice_.core_id}` "
+                 f"(image: {slice_.image or 'custom'})")
+    # Console: a Yocto slice uses the Linux console (kernel console = the
+    # SoM's debug UART via the `console=` kernel cmdline; userspace printf
+    # goes to stdout/the controlling tty).  This is the Linux half of the
+    # generic console auto-selection -- nothing to set in local.conf; the
+    # BSP owns the `console=ttySC*` cmdline.  (Zephyr slices get the Alp
+    # UART console instead; see _emit_zephyr_console.)
+    console = _resolve_console((project.diagnostics or {}).get("console"),
+                               slice_.os)
+    if console == "linux":
+        lines.append("# Console: Linux console (kernel `console=` cmdline "
+                     "-> SoM debug UART; userspace -> stdout/tty).")
+    lines.append(f'MACHINE = "{machine}"')
+    if slice_.peripherals:
+        joined = ", ".join(sorted(slice_.peripherals))
+        lines.append("# Peripherals declared for this Yocto slice are "
+                     f"BSP/kernel-owned ({joined}); no Zephyr Kconfig or "
+                     "local.conf package knob is emitted here.")
+    iot_lines = _yocto_iot_lines(project, slice_)
+    if iot_lines:
+        lines.extend(iot_lines)
+    # `cameras:` -> ALP_CAMERA_CAM<n>, the variable the kernel bbappend keys
+    # the sensor devicetree include on (same resolver as Zephyr's -DSHIELD).
+    lines.extend(_cameras.yocto_camera_lines(project, slice_))
+    # Curated third-party libraries (top-level `libraries:`, ADR 0018) with a
+    # Yocto integration section -- BOTH the project-wide entries and the ones
+    # scoped to this core.  Every recipe name comes from the library's own
+    # `integration.yocto.image_install:`; nothing is derived from the library
+    # name.  (alplabai/tan-cli#555: the core-scoped half used to bypass the
+    # library layer entirely and emit `lib-<name>` -- a recipe that RPROVIDES
+    # nothing, so `bitbake alp-image-edge` died on `Nothing RPROVIDES
+    # 'lib-mbedtls'`.)  Guard keeps a project with no such libraries
+    # byte-identical.
+    for name in _library_layer.yocto_unwireable(
+            project, slice_, project.effective_metadata_root()):
+        lines.append(f"# library `{name}`: manifest declares no "
+                     f"`integration.yocto:` section -- nothing to add to "
+                     f"IMAGE_INSTALL on core `{slice_.core_id}`.")
+    library_pkgs = _library_layer.yocto_image_install(
+        project, slice_, project.effective_metadata_root())
+    if library_pkgs:
+        joined = " ".join(library_pkgs)
+        lines.append(f'IMAGE_INSTALL:append = " {joined}"')
+    # SoM-declared AUTO accelerator preference.  Read by the alp-sdk recipe
+    # (EXTRA_OECMAKE -> -DALP_SDK_INFERENCE_AUTO_ORDER); only the
+    # .alpmodel selector (alp_model_select) consumes it, as a tiebreak.  Weak `?=` so a hand-edited
+    # local.conf wins; emitted only for presets that declare it.
+    auto_order = _inference_auto_order(project.som_preset)
+    if auto_order:
+        lines.append(f'ALP_SDK_INFERENCE_AUTO_ORDER ?= "{",".join(auto_order)}"')
+    if slice_.image:
+        lines.append(f"# bitbake target: {slice_.image}")
+
+    # Mender OTA wiring (board.yaml `ota:` block).  Emits Mender
+    # `?=` (weak) assignments so hand-edited local.conf values in
+    # the build dir still win.
+    ota = project.ota or {}
+    if ota.get("provider") == "mender":
+        lines.append("")
+        lines.append("# OTA (board.yaml `ota:` block)")
+        lines.append('INHERIT += "mender-full"')
+        if ota.get("artifact_name"):
+            lines.append(f'MENDER_ARTIFACT_NAME ?= "{ota["artifact_name"]}"')
+        srv = ota.get("server") or {}
+        if srv.get("url"):
+            lines.append(f'MENDER_SERVER_URL ?= "{srv["url"]}"')
+        tenant = str(srv.get("tenant") or "")
+        if "${" in tenant:
+            # A ${NAME} placeholder is never expanded by BitBake from the
+            # host environment, so a self-referencing `?=` would bake the
+            # literal text (or fail to expand).  Leave the token to the
+            # documented local.conf override instead.
+            lines.append(
+                "# MENDER_TENANT_TOKEN: set it in conf/local.conf "
+                "(meta-alp-sdk/README.md, Mender step 3); the board.yaml "
+                "placeholder is not expanded by BitBake."
+            )
+        elif tenant:
+            lines.append(f'MENDER_TENANT_TOKEN ?= "{tenant}"')
+        sto = ota.get("storage") or {}
+        if sto.get("device"):
+            lines.append(f'MENDER_STORAGE_DEVICE_BASE ?= "{sto["device"]}"')
+        if sto.get("boot_part_mb"):
+            lines.append(f'MENDER_BOOT_PART_SIZE_MB ?= "{sto["boot_part_mb"]}"')
+        if sto.get("total_size_mb"):
+            lines.append(f'MENDER_STORAGE_TOTAL_SIZE_MB ?= "{sto["total_size_mb"]}"')
+        if ota.get("poll_interval_s"):
+            lines.append(f'MENDER_INVENTORY_INTERVAL ?= "{ota["poll_interval_s"]}"')
+
+    return "\n".join(lines) + "\n"
+
+
+def _slice_cmake_args(project: BoardProject, slice_: Slice) -> str:
+    """Per-core cmake -D args for a baremetal / yocto slice.
+
+    NPU-dispatch enables (DRP-AI, DEEPX) are driven from the SoM
+    preset's `capabilities:` matrix -- never from board.yaml.  On
+    multi-NPU SKUs (V2M101 = DRP-AI3 + DEEPX DX-M1) every available
+    NPU is enabled so apps can dispatch concurrent independent models
+    via alp_inference_open(.backend=...) per-handle.
+    """
+    family = project.som_preset.get("family") or "unknown"
+    # resolve_capabilities merges SoC-JSON defaults with SoM overrides.
+    capabilities = resolve_capabilities(project.som_preset, project.effective_metadata_root())
+    lines: list[str] = []
+    lines.append("# Auto-generated by scripts/alp_orchestrate.py "
+                 "-- pass to cmake.")
+    lines.append(f"-DALP_SOM_SKU={project.sku}")
+    lines.append(f"-DALP_SOM_FAMILY={family}")
+    # Per-SKU capability-restriction gate for <alp/soc_caps.h>: emitted
+    # ONLY when the SoM preset declares `silicon_capabilities.unpopulated`,
+    # so every unrestricted SKU's cmake-args output stays byte-identical.
+    if som_unpopulated_capabilities(project.som_preset):
+        lines.append(f"-DALP_SOM_{_som_define_slug(project.sku)}")
+    lines.append(f"-DALP_CORE_ID={slice_.core_id}")
+    # Cross-EVK board facade selector (<alp/board.h>).
+    # Emitted only when the project resolves to a named board preset
+    # (e.g. `preset: e1m-x-evk` -> board_name "E1M-X-EVK").
+    # Inline boards with no preset/name skip this; the facade defaults
+    # to an #error forcing the builder to set it explicitly (e.g. via
+    # extra_args for native_sim testcases).
+    if project.board_name:
+        lines.append(f"-DALP_BOARD_{_board_define_slug(project.board_name)}")
+    if slice_.toolchain:
+        lines.append(f"-DALP_TOOLCHAIN={slice_.toolchain}")
+    # `cameras:` -> the same -DSHIELD the build command carries.
+    shield = _cameras.shield_define_for_build(project, slice_)
+    if shield:
+        lines.append(f"-D{shield}")
+    if capabilities.get("drp_ai"):
+        # Must match the option name in src/yocto/CMakeLists.txt
+        # (ALP_SDK_USE_DRPAI_V2N -- compiles inference_drpai.cpp).
+        lines.append("-DALP_SDK_USE_DRPAI_V2N=ON")
+    if capabilities.get("deepx_dxm1"):
+        lines.append("-DALP_SDK_USE_DEEPX_DXM1=ON")
+    # Project-wide curated third-party libraries (top-level `libraries:`,
+    # ADR 0018) with a baremetal integration section.  Guard keeps a project
+    # with no such libraries byte-identical.
+    for arg in _library_layer.baremetal_cmake_args(
+            project, slice_, project.effective_metadata_root()):
+        lines.append(arg)
+    return "\n".join(lines) + "\n"