Merge pull request #216 from retroSoC/dev

Dev

docs/README.md

@@ -5,8 +5,10 @@ the root README and subsystem guides.
 
 - [Tiny Gen1 QFN64](ip/tiny-soc.md) freezes shared RNG/CRC/WS2812/Crypto,
   eight-channel DMA and Tiny-owned RCU, no-PLL 96 MHz / PLL 240 MHz clock and
-  reset trees, and the unchanged package budget. It distinguishes these
-  targets from the existing 24 MHz implementation and physical evidence.
+  reset trees, DVP V2 camera routing and optional XPI PSRAM frame buffers,
+  with the unchanged package budget. P10 -> P7 -> P8 -> P11 -> P12 -> P9 is
+  the remaining execution order; P0-P9 IDs/titles are preserved. These targets
+  remain separate from the existing 24 MHz implementation and physical evidence.
 - [Tiny Gen1 datasheet](../publications/datasheets/tiny/README.md) describes the
   current 24 MHz implementation, registers, software and qualification boundary;
   it does not yet describe the QFN64 Gen1 target.

docs/ip/README.md

@@ -6,8 +6,10 @@ extension interfaces.
 
 - [Tiny Gen1 QFN64](tiny-soc.md) freezes shared RNG/CRC/WS2812/Crypto,
   eight-channel DMA, Tiny-specific RCU and no-PLL 96 MHz / PLL 240 MHz clock
-  and reset trees while preserving the package/pad budget. The current
-  24 MHz implementation and its evidence remain explicitly separate.
+  and reset trees while preserving the package/pad budget. P10 adds unchanged
+  DVP V2, GPIO12-23 ALT1 and optional XPI NSS1 PSRAM frame buffers; the execution
+  order is P10 -> P7 -> P8 -> P11 -> P12 -> P9 without renumbering old phases.
+  The current 24 MHz implementation and its evidence remain explicitly separate.
 
 - [timer.md](timer.md) defines the dual APB4 general timer.
 - [sysctrl.md](sysctrl.md) defines the APB4 SystemCtrl register ABI, control-plane contracts, HAL, and verification.

docs/ip/dma.md

@@ -7,10 +7,16 @@ IRQ20. DMA does not use RIB or a RIB-to-AXI4 adapter.
 
 The register ABI, IP implementation and HAL are shared across products.
 The [Tiny Gen1 target](tiny-soc.md) keeps `0x1000A000`, IRQ20 and eight
-channels, but assigns channel 2 to general transfers, 3 to XPI/WS2812/CRC,
+channels, but assigns channel 2 to DVP receive (general transfers only after
+camera ownership is released), 3 to XPI/WS2812/CRC,
 4/5 to Crypto and 6/7 to I2S TX/RX; 0/1 remain UART0/I2C0. Its streams and
 DMA engine share PCLK, with an AXI CDC into SYS. Product capability/routing
 data must reject absent endpoints without a blanket Tiny stream prohibition.
+Tiny DVP keeps request selector 11 and remains unsupported until its P12
+integration; a reserved/tied-off stream port is not support. The DVP stream
+can target XPI NSS1 mapped PSRAM using ordinary AXI writes without selecting
+XPI's indirect DMA request or creating another master. Device capacity and
+serial-burst limits come from the initialized product memory configuration.
 These are frozen Tiny requirements, not implemented Tiny or timing evidence.
 
 ## Scope and limits

docs/ip/dvp.md

@@ -18,9 +18,18 @@ capture, and rectangular cropping.
 | Input interface | 8-bit parallel data, PCLK, HREF, VSYNC |
 | AXI4-Stream data width | 32 bits |
 | AXI4-Stream frame markers | `TUSER[0]` SOF, `TLAST` EOL |
-| DMA request selector | `DVP_RX` on bulk DMA channel 3 |
+| DMA request selector | `DVP_RX=11`; Mini default bulk DMA channel 3 |
 | ABI version | `0x00020000` |
 
+The [Tiny Gen1 target](tiny-soc.md) reuses this IP specification and ABI
+unchanged at the same base/core IRQ, with product-selected DMA channel 2,
+PCLK host/stream, GPIO12-23 ALT1 camera routing and optional XPI NSS1 PSRAM
+frame buffers. Camera and I2S profiles are mutually exclusive. Its P12
+integration must validate exact transfer length, shared HAL channel/burst
+binding and final-word drain without changing the DVP registers, formats,
+FIFO or stream semantics. Tiny support remains a frozen target, not existing
+end-to-end or physical evidence; Mini's channel-3 default remains unchanged.
+
 The pixel clock is buffered and can be inverted before the pixel-domain reset
 synchronizer. Configuration and frame statistics cross between the system and
 pixel domains through the common `cdc_2phase` primitive. Captured payloads use
@@ -111,10 +120,13 @@ The DMA MVP treats each full AXI4-Stream word as one 32-bit memory write.
 It accepts only `TKEEP=4'hf`; an odd-pixel DVP line produces a partial final
 word and therefore requires PIO handling or a future narrow-transfer/DRE DMA
 extension. Software should configure the frame and crop dimensions, clear
-stale error and interrupt state, program the channel-3 `DVP_RX` destination
+stale error and interrupt state, program the product-selected `DVP_RX` destination
 and capacity, enable stream output, and then start DVP capture. A frame that
 reports overflow, synchronization, partial, DMA, or abort errors must not be
 consumed by software.
+The existing convenience helper uses Mini's channel-3 binding; Tiny must
+supply its product transport configuration as specified in its integration
+contract before that helper is advertised as supported there.
 
 The public HAL exposes structured configuration, bounded status polling,
 command and interrupt control, capability discovery, and a convenience API

docs/ip/tiny-soc-verification.md

@@ -7,30 +7,34 @@ when that evidence was collected; its recorded readiness remains `prototype`.
 
 The baseline has two UARTs, two I2C controllers and the legacy pad mapping.
 These results do not validate the 2026-09-26 QFN64 package refreeze or the
-2026-09-30 shared-IP/clock/reset refreeze. The no-PLL 96 MHz / PLL 240 MHz
-targets, eight-channel DMA, RNG/CRC/WS2812/Crypto, Tiny RCU, I2S/SDIO and new
-clock/reset/pad integration require separate current-revision evidence. The
-historical results below are retained without promotion to Gen1 qualification.
+2026-09-30 shared-IP/clock/reset or 2026-10-01 DVP/XPI-framebuffer refreezes.
+The no-PLL 96 MHz / PLL 240 MHz targets, eight-channel DMA,
+RNG/CRC/WS2812/Crypto, Tiny RCU, I2S/SDIO and new
+clock/reset/pad integration, DVP and optional XPI PSRAM require separate
+current-revision evidence. The historical results below are retained without
+promotion to Gen1 qualification.
 
-## P6 freeze and pending Gen1 verification
+## P6/P10 freezes and pending Gen1 verification
 
-P6 is documentation-only. The matrix below specifies required P7-P9 coverage;
+P6 and P10 are documentation-only. The remaining execution order is
+P10 -> P7 -> P8 -> P11 -> P12 -> P9, preserving all P0-P9 phase IDs/titles.
+The matrix below specifies required implementation and qualification coverage;
 it records no newly executed RTL, firmware, formal, synthesis or timing result.
 The existing committed IHP130 Tiny profile remains the 24 MHz baseline until
 the implementation phases introduce reviewed configurations.
 
 | Area | Required cases / acceptance | Evidence status |
 | --- | --- | --- |
-| Addresses and software | Match Mini bases for RNG/CRC/WS2812/Crypto and the SYSCTRL control entry; one RCU decode; handwritten register parity; common drivers with product-selected clock/routing context. | Pending P7/P8 |
-| Package and pinmux | Exactly 64 unique perimeter pins, 32 GPIO and 16 power/ground terminals; only GPIO26 ALT0 added for WS2812; GPIO26 alternate I2C exclusion; pad-safe reset and default-interface concurrency. | Document consistency in P6; RTL/Pad evidence pending |
-| DMA and fabric | Eight channels, Crypto 4/5 and I2S 6/7 concurrently, serialized channel-3 clients, three AXI32 masters, target/page/alignment errors, backpressure, abort drain, omitted endpoint rejection and IRQ propagation. | Pending P7 |
+| Addresses and software | Match Mini bases for RNG/CRC/WS2812/Crypto/DVP and the SYSCTRL control entry; one RCU decode; unchanged DVP V2 ABI at `0x1000E000`/IRQ15; handwritten parity and common drivers with product-selected clock/routing context. | Pending P7/P8/P12 |
+| Package and pinmux | Exactly 64 unique perimeter pins, 32 GPIO and 16 power/ground terminals; preserve the P6 perimeter/power table and all assigned alternates; add only GPIO12-23 ALT1 camera functions; 28 distinct GPIO with optional controls; GPIO26 alternate I2C exclusion, audio/camera exclusion, safe reset and default-interface concurrency. | Documentation scope P10; RTL/Pad evidence pending P8/P12/P9 |
+| DMA and fabric | Eight channels, Crypto 4/5 and I2S 6/7, serialized channel-3 clients, exclusive camera DMA2/request 11, three AXI32 masters, target/page/alignment errors, backpressure, abort drain and IRQ propagation. Absent DVP remains unsupported before P12; no private DVP master. | Pending P7/P12 |
 | Shared IP lifecycle | RNG unqualified/fault/duplicate handling, CRC tails and FINISH after DMA, WS2812 pulse/reset timing, Crypto six-bank init/readback/lock, AES/SHA/RSA vectors, reset/abort/zeroize and no early erasure acknowledgement. | Pending Tiny P7/P9; standalone results remain separately scoped |
 | Clock profiles | Safe24, external XIN24/48/96, PLL192/240 model cases; SYS/MEM/PCLK rates; 1 MHz CLINT continuity; SDIO init at <=400 kHz and 48/48/40 MHz target rates. | Pending P8 |
 | Clock commands and failures | Invalid/unsupported profile, partial/unmapped access, busy rejection, drain/CDC timeout, lock timeout, PLL stopped high/low, no mixed profile commit and consistent safe fallback. | Pending P8 |
 | Reference loss | Stop XIN and observe loss of REF24/WDG progress; restore the external source and RESET_N before restart; no autonomous recovery claim. | Pending P8/board evidence |
-| Reset and gating | Cold/warm/watchdog/hart/peripheral reset; five-edge local release, CPU-last ordering, WFI/IRQ/debug ungating, gated MMIO error, unilateral CDC reset, missing AUDIO clock and Crypto READY not blocking CPU startup. | Pending P8 |
+| Reset and gating | Cold/warm/watchdog/hart/peripheral reset; five-edge local release, CPU-last ordering, WFI/IRQ/debug ungating, gated MMIO error and unilateral CDC reset. Missing AUDIO/PIXCLK and Crypto READY must not block CPU startup; DVP target bit 14 unsupported before actual integration. | Pending P8/P12 |
 | Timing-aware shared software | UART/I2C/WS2812 configuration at PCLK24/48/60; PWM CLOCK_HZ matches committed rate; shared-IP upgrade and Mini consumer compatibility; no managed-tree patch or Tiny HAL fork. | Pending shared upgrade/P8 |
-| Physical and security qualification | Characterized 96 MHz input receiver, oscillator/PLL/backend, SYS240/MEM120/PCLK60 timing, CDC/RDC, reset fanout, SRAM macros, PVT/post-layout, supply/package/IO integrity and qualified entropy source. | Pending P9; no current qualified PLL profile |
+| Physical and security qualification | Characterized 96 MHz input receiver, oscillator/PLL/backend, SYS240/MEM120/PCLK60 timing, pixel/serial Pad timing, CDC/RDC, reset fanout, SRAM macros, PVT/post-layout, supply/package/IO integrity, sensor/PSRAM electrical compatibility and qualified entropy source. | Pending P9; no current qualified PLL profile |
 
 Each implementation result must identify its source revision, exact profile,
 PDK/library corner and build variant. Use both supported RTL simulators with
@@ -39,6 +43,70 @@ physical gates. Run affected Mini regressions for shared changes without
 using those results as Tiny evidence. Do not remove PLL/STA guards or revise
 warning/metric baselines to relabel an unsupported or failing flow as passing.
 
+### DVP and XPI framebuffer acceptance matrix
+
+All rows below are pending; the P10 freeze does not execute them. Scope each
+result to the committed IHP130 24 MHz baseline or the exact P8-introduced
+configuration. Neither an unimplemented profile nor a behavioral PLL result
+is a physically qualified operating point.
+
+| Requirement / phase | Required cases and objective evidence |
+| --- | --- |
+| TINY-022/026, P8/P12 | GPIO12-19 data, GPIO20 raw PIXCLK, GPIO21 HREF, GPIO22 VSYNC, GPIO23 CAM_XCLK; preserve GPIO28 ALT0 as the same CLKOUT generator; off after reset, REF24/2=12 MHz, dual-route mirroring and disable-before-change. Verify camera/I2S/PWM conflicts and board inactive-driver isolation. |
+| TINY-024, P11 | NSS1/GPIO29, actual 8 MiB reference geometry at `0x54000000..0x547FFFFF` within the 64 MiB aperture; device identity/init/reset, read/write LUT, SCK/CS/dummy settings, CPU and central-DMA full readback/CRC plus guard regions. Use the XPI pins, not a substituted RAM or separate controller. |
+| TINY-024/025, P11 | First/last device words, allocation end and overflow, 4 KiB and serial boundaries, chosen alignment and bursts up to 16 words, maximum CS duration, wrong/absent device, timeout/abort/reset/reinitialization. Failure must not alter NOR data, boot LUT or mapped-write disable. |
+| TINY-027, P11 | Per-profile mapped-write payload throughput and maximum observed backpressure, with recorded clock/LUT/burst/device settings and exercised contention. Use these measurements to define a tested input-rate budget; capacity alone is not a rate bound. |
+| TINY-021/023, P12 | Execute existing DVP V2 register/format/framing/IRQ tests; connect APB/IRQ15 and stream request 11 to DMA2; truthful capability before/after integration, no changed FIFO/ABI, no extra master. Mini retains its default channel-3 binding. |
+| TINY-021/024/025, P12 | End-to-end RGB565 and YUV422 snapshots/crops; repeated capture; full QVGA (153600-byte) and VGA (614400-byte) external frames at a safe measured rate; SRAM capture only with complete memory budget. Check every output byte, guard regions, DVP statistics and exact DMA byte count. |
+| TINY-025, P12 | Allocation larger than frame still programs exact frame length; even cropped width accepted; odd DMA width/insufficient capacity/invalid range rejected before start; odd-width PIO retained. Delay final stream word and AXI write response after DVP frame-done: no early flush, abort or valid-buffer publication. |
+| TINY-025/026, P12 | Backpressure/overflow, malformed sync/partial frame, DMA/XPI errors, lost/stopped-high/stopped-low PIXCLK, reset/abort/rearm and audio/camera mode changes. Invalid frames are discarded; accepted AXI work drains or the reset session is explicitly lost. CPU/APB stays usable without PIXCLK; no false reset-done with missing edges/barriers. |
+| TINY-024/027, P12/P9 | NOR boot with PSRAM present/absent/failing, SRAM-resident XPI reconfiguration including interrupt paths, capture-then-readback/SDIO-save ordering and explicit blocking-traffic exclusions. Archive tested PIXCLK and margins, not a general FPS guarantee. |
+
+The complete DVP -> DMA -> AXI -> XPI -> PSRAM route must execute with a
+pin-level PSRAM model in Icarus and Verilator and firmware terminal verdicts
+where applicable. The Verilator `--fast-flash` backend rejects writes,
+nonzero slots and modified LUTs; it cannot supply framebuffer evidence.
+`tests/test_psram.py` tests a different PSRAM controller, and
+`tests/test_xpi_io.py` is a shared PHY/LUT check, not this complete route.
+`tests/test_dvp.py` is standalone framing evidence and can return without
+executing RTL when tools are missing. Check actual simulator execution and
+pass markers; a collected/skipped/no-op host test is not hardware coverage.
+
+P11/P12 must add integrated cases through the normal test/regression flow,
+record exact commands and retain full logs, source/profile/PDK identity,
+guards/readback checks and error snapshots. Reuse the existing PSRAM device
+model under shared/Tiny verification ownership without importing Mini product
+RTL or duplicating its controller. Keep hardware coverage separate from
+host-only length/range/HAL tests, physical device qualification and continuous
+video delivery. Shared HAL fixes require affected Mini compatibility runs.
+
+### P10 documentation checks (2026-10-01)
+
+Local document checks passed: unchanged perimeter/power tables, 64 unique
+terminal numbers, 32 GPIO with exactly twelve new ALT1 routes, 28 distinct
+camera-profile GPIO including optional controls, unchanged P0-P9 headings,
+thirteen unique phase headings and correct frame-byte/KiB/DMA-word arithmetic.
+The DVP register/stream sections, Tiny 24 MHz baseline and historical executed
+results below were compared against the preceding revision and are unchanged.
+All 111 local Markdown links in the nine changed documents passed, and the
+two camera references were checked against their official sources.
+
+Command selection was checked on Windows using the installed `python` entry
+point (`python3` resolves to an unavailable Store launcher in this shell);
+both dry-runs succeeded:
+
+```sh
+python scripts/regress.py --root . --suite pr --pdk IHP130 --soc TINY --dry-run
+python scripts/regress.py --root . --suite nightly --soc TINY --dry-run
+git diff --check
+```
+
+The selected profile remains `configs/ci/ihp130-tiny.mk`, IHP130, 24 MHz/no
+PLL. `git diff --check` passed. P10 changes documentation only: firmware,
+RTL simulations/formal, synthesis/netlist/STA, full quality/regression suites
+and physical gates were not run. No C/MISRA deviation, configuration,
+dependency, warning baseline or metrics policy change is made or implied.
+
 ## Configuration and artifact roots
 
 The selected profile is `configs/ci/ihp130-tiny.mk`: IHP130, 128 KiB SRAM,

docs/ip/tiny-soc.md

@@ -1,13 +1,17 @@
-# retroSoC Tiny Gen1 Product, Shared IP and Clock/Reset Contract
+# retroSoC Tiny Gen1 Product, Shared IP, Camera and Clock/Reset Contract
 
 ## Purpose and research boundary
 
-This contract freezes the shared-IP and clock/reset design approved on
-2026-09-30 for Target SoCs: `TINY`, feature slug `tiny-soc`. It preserves the
-QFN64 package and pad allocation approved on 2026-09-26, adds RNG, CRC,
-WS2812, Crypto and a Tiny-specific RCU, and expands central DMA to eight
-channels. It supersedes the earlier 144 MHz target with a maximum SYS/processor
-target of 96 MHz without PLL and 240 MHz with PLL. Both variants boot from a
+This contract incorporates the DVP/XPI-framebuffer design approved on
+2026-10-01 for Target SoCs: `TINY`, feature slug `tiny-soc`. It preserves the
+QFN64 package and pad allocation approved on 2026-09-26 and the 2026-09-30
+shared-IP/clock/reset freeze: RNG, CRC, WS2812, Crypto, Tiny-specific RCU and
+eight-channel central DMA. The added camera profile reuses DVP V2 unchanged
+and permits whole-frame buffers in optional XPI-connected PSRAM. It does not
+add pads, a DMA channel, a memory controller or an AXI master.
+
+The clock contract supersedes the earlier 144 MHz target with a maximum
+SYS/processor target of 96 MHz without PLL and 240 MHz with PLL. Both variants boot from a
 24 MHz reference-derived safe clock. No independent safety RC is added.
 
 This is a specification freeze, not evidence of implemented or qualified
@@ -24,20 +28,23 @@ contract and must not be read as the new Gen1 integration or clock qualification
 
 Product RTL, address/pin/topology inputs and filelists remain under `rtl/tiny`;
 the SDK and application composition retain their existing `crt/` and `app/`
-ownership. P7-P9 below must implement and validate the target separately.
+ownership. The remaining execution order is P10 (this documentation freeze),
+P7, P8, P11, P12, then P9; stable phase numbers are not dependency order.
 The current profile still selects four DMA channels and forbids PLL/non-24-MHz
 Tiny configurations. New configurations require explicit platform enablement.
 
 ### Commercial references and reuse boundary
 
-The following primary references were reviewed during the 2026-09-30 research.
+The following primary references were reviewed during the 2026-09-30 research;
+the camera references were checked on 2026-10-01.
 Vendor frequencies, power figures and security qualifications are not Tiny
 PPA or signoff evidence; no proprietary implementation is copied.
 
 | Reference | Relevant architecture and delivery | Selected reuse / boundary |
 | --- | --- | --- |
 | [RP2350 hardware APIs](https://www.raspberrypi.com/documentation/pico-sdk/hardware.html) and [datasheet](https://pip-assets.raspberrypi.com/categories/1214-rp2350/documents/RP-008373-DS-2-rp2350-datasheet.pdf?disposition=inline) | Maintained reference/system-clock services, peripheral resets and a Hazard3-capable MCU. The published datasheet describes safe mux/divider ordering and independent clock sources. | Separate reference timekeeping from processor clocks, acknowledge clock changes, and reset peripherals explicitly. Tiny does not inherit RP2350's internal oscillators, power domains or automatic recovery. Its 96 MHz XIN receiver needs its own qualification. |
-| [STM32H573 datasheet](https://www.st.com/resource/en/datasheet/stm32h573vi.pdf) | DS14121 Rev 5 describes a 250 MHz MCU with domain prescalers, clock gating, reset control, configurable CRC, RNG and crypto accelerators; the product is in volume production. | Share peripheral software contracts while keeping product clock/reset control separate. Do not import TrustZone, protected-key, independent-watchdog-clock or TRNG certification claims. |
+| [STM32H573 datasheet](https://www.st.com/resource/en/datasheet/stm32h573vi.pdf) | DS14121 Rev 5 (May 2025) describes a production 250 MHz MCU with domain controls, CRC/RNG/crypto and a parallel camera interface supporting snapshot/continuous capture and cropping. | Reuse the snapshot/crop programming pattern and separate product clock control. Do not import its wider camera bus, JPEG support, TrustZone, protected-key, independent-watchdog-clock or TRNG certification claims. |
+| [Espressif camera driver](https://github.com/espressif/esp32-camera) | The official ESP32/ESP32-S2/ESP32-S3 driver documents PSRAM frame buffers and PSRAM DMA on S2/S3; it warns that raw RGB/YUV writes can lose data when bandwidth is insufficient. Single-buffer capture and multiple-buffer continuous capture have different memory/bandwidth costs. | Use external RAM capacity with explicit throughput and worst-stall checks. Tiny selects one-frame capture/readback first, not a descriptor ring, compression path or guaranteed continuous frame rate. The maintained driver is a software reference, not Tiny silicon, power or timing evidence. |
 | [GD32F450 datasheet](https://gd32mcu.com/data/documents/datasheet/GD32F450xx_Datasheet_Rev2.3.pdf) | Rev 2.3 describes 200 MHz AHB domains, 50/100 MHz APB domains and RCU-managed clocks/resets. | Use explicit domain ceilings and dividers rather than assigning the processor frequency to every peripheral. No analog macro, process-specific voltage or measured PPA is reused. |
 
 The [RP2350](https://www.raspberrypi.com/products/rp2350/) is a Hazard3-based MCU
@@ -54,13 +61,15 @@ no commercial implementation or qualification is reused.
 - TINY-002: native 32-bit AXI4 data and APB4 control. The CPU's native AHB-Lite
   terminates at a direct AXI adapter. No RIB/RIBP source or interface is part of
   Tiny's compilation or elaboration closure.
-- TINY-003: 128 KiB technology-backed SRAM, XPI NOR boot, no external RAM
-  dependency. Reset vector is `0x00000000`; SRAM begins at `0x30000000`.
+- TINY-003: 128 KiB technology-backed SRAM and XPI NOR boot. Boot and baseline
+  firmware MUST NOT depend on external RAM. Reset vector is `0x00000000`;
+  SRAM begins at `0x30000000`. Optional initialized XPI PSRAM may hold frame
+  data; code, vectors and stack retain SRAM residency.
 - TINY-004: 32 bidirectional user GPIO, one UART, one I2C controller, one
   full-duplex I2S controller, one SDIO host, two general timers, CLINT, eight
   central DMA channels, four PWM outputs, RTC, watchdog, RNG V2, CRC V2,
-  WS2812, Crypto V2, Tiny RCU/SYSCTRL and architecture info. UART1 and I2C1
-  are absent from the Gen1 target.
+  WS2812, Crypto V2, DVP V2, Tiny RCU/SYSCTRL and architecture info. UART1 and
+  I2C1 are absent from the Gen1 target.
 - TINY-005: retain `HAVE_PLL` as the single PLL build selector. With no PLL,
   use an external XIN clock up to 96 MHz; with PLL, use a 24 MHz reference and
   the single-output PLL interface for a maximum 240 MHz SYS/processor target.
@@ -108,18 +117,49 @@ no commercial implementation or qualification is reused.
   and shared-driver timing must agree after each completed change.
 - TINY-018: resets MUST assert asynchronously and release on five valid local
   clock edges, with CDC restart barriers and CPU-last boot release. A stopped
-  audio clock or software-initialized Crypto READY MUST NOT block CPU startup.
+  audio/pixel clock or software-initialized Crypto READY MUST NOT block CPU
+  startup.
 - TINY-019: no independent safety RC, backup clock or automatic recovery from
   XIN loss is provided. Restore the external source and apply RESET_N to
   recover. A PLL-only fault may recover through REF24 while XIN remains valid.
 - TINY-020: preserve RNG qualification/fail-closed behavior and Crypto V2
   initialization, invalidation and verified physical erasure. Crypto's six
   private SRAM banks MUST NOT reduce the 128 KiB software-visible SRAM.
+- TINY-021: MUST reuse [DVP V2](dvp.md), its 8-bit RGB565/YUV422 formats,
+  registers, snapshot/continuous/crop functions and stream framing unchanged.
+  Tiny's first acceptance MUST cover snapshots and cropping; MUST NOT add
+  JPEG, raw formats, frame rings, stride, a private DVP AXI master or a larger
+  FIFO under this freeze. Continuous no-loss video qualification is deferred.
+- TINY-022: MUST add only GPIO12-23 ALT1 camera routes, preserve all P6-assigned
+  Gen1 alternates and QFN64/power assignments, and make camera and I2S profiles
+  mutually exclusive. CAM_XCLK MUST share the existing RCU CLKOUT generator.
+- TINY-023: MUST preserve DVP base `0x1000E000`, IRQ15 and request `DVP_RX=11`,
+  use Tiny central DMA channel 2 by default, and retain eight channels and
+  three AXI masters. Endpoint and RCU target capabilities MUST reflect actual
+  integration, not a reserved port or planned phase.
+- TINY-024: MUST support whole-frame storage through XPI NSS1 at `0x54000000`
+  using GPIO29 ALT0, after device initialization/validation. Preserve NSS0 NOR
+  boot and SRAM-only operation; MUST NOT add a separate PSRAM controller or
+  a `0x40000000` memory window. Actual capacity, not the slot aperture, bounds
+  buffers; 128 KiB SRAM MUST NOT be presented as a DVP resolution ceiling.
+- TINY-025: MUST validate exact frame length, alignment, even DMA output width,
+  device capacity and burst/CS boundaries. A valid frame requires DVP frame
+  completion, all DMA destination writes completed, exact byte count and no
+  DVP/DMA/XPI error. MUST NOT flush the undrained tail on the success path.
+- TINY-026: MUST retain the shared pixel CDC/reset topology, add Tiny RCU
+  target bit 14 without moving existing bits, and bound clock-loss/recovery
+  waits. Software MUST quiesce capture/DMA before clock, gate or route changes.
+- TINY-027: ACCEPTANCE requires pin-level XPI PSRAM CPU/DMA readback, measured
+  write throughput/worst backpressure, and end-to-end DVP capture/readback in
+  each supported profile. Fast read-only NOR or separate-controller tests
+  MUST NOT substitute for this evidence; no supported PIXCLK/FPS is inferred
+  from CAM_XCLK, CPU frequency or external RAM capacity alone.
 
 Deferred: RV32 A atomics, RTOS ports, authenticated boot, retention/power gating,
 independent sleep clock, 256-512 KiB SRAM, USB, standalone general SPI, CAN, ADC,
-multimedia accelerators and other PDK qualification. I2S and SDIO are Gen1
-requirements awaiting integration, not deferred product features. XPI retains
+multimedia accelerators beyond the selected DVP capture path and other PDK
+qualification. I2S, SDIO and DVP are Gen1 requirements awaiting integration,
+not deferred product features. XPI retains
 four chip selects: CS0_N is dedicated to boot NOR, while CS1_N through CS3_N
 use GPIO29 through GPIO31. Additional XPI device configurations still require
 their own qualification.
@@ -218,8 +258,9 @@ drive-strength control in the current GPIO ABI.
 | 32 | VSSCORE_B | 64 | JTAG_TRST_N |
 
 Boot Flash occupies pins 3-8, SDIO occupies pins 19-24, I2S occupies pins
-35-40 including its optional reference input, and clock analog/control signals
-occupy pins 53-59. Both PLL variants retain pins 53-56 as AVDD_CLK, AVSS_CLK,
+35-40 including its optional reference input, and the alternate camera profile
+occupies pins 35-46. Clock analog/control signals occupy pins 53-59. Both PLL
+variants retain pins 53-56 as AVDD_CLK, AVSS_CLK,
 XIN and XOUT. External-clock mode disables XOUT drive without deleting the
 pad or changing the package numbering. Clock supply voltage and bypass-input
 electrical limits require the selected macro/Pad binding.
@@ -245,18 +286,18 @@ but is not yet implemented by the current Tiny canonical maps.
 | GPIO9 | 28 | UART0_RX | PWM1 | Default UART RX |
 | GPIO10 | 29 | I2C0_SCL | PWM2 | Default open-drain I2C clock with readback |
 | GPIO11 | 30 | I2C0_SDA | PWM3 | Default open-drain I2C data with readback |
-| GPIO12 | 35 | I2S_BCLK | Reserved | Master output or slave input |
-| GPIO13 | 36 | I2S_LRCLK | Reserved | Master output or slave input |
-| GPIO14 | 37 | I2S_DOUT | Reserved | Audio data output |
-| GPIO15 | 38 | I2S_DIN | Reserved | Audio data input |
-| GPIO16 | 39 | I2S_MCLK | Reserved | Optional audio master-clock output |
-| GPIO17 | 40 | I2S_REFCLK_IN | Reserved | External audio-reference input |
-| GPIO18 | 41 | PWM0 | Reserved | Default PWM channel 0 output |
-| GPIO19 | 42 | PWM1 | Reserved | Default PWM channel 1 output |
-| GPIO20 | 43 | PWM2 | Reserved | Default PWM channel 2 output |
-| GPIO21 | 44 | PWM3 | Reserved | Default PWM channel 3 output |
-| GPIO22 | 45 | PWM_FAULT | Reserved | PWM fault input |
-| GPIO23 | 46 | PWM_SYNC | Reserved | PWM synchronization input |
+| GPIO12 | 35 | I2S_BCLK | DVP_D0 | Audio clock or camera data input 0 |
+| GPIO13 | 36 | I2S_LRCLK | DVP_D1 | Audio clock or camera data input 1 |
+| GPIO14 | 37 | I2S_DOUT | DVP_D2 | Audio data output or camera data input 2 |
+| GPIO15 | 38 | I2S_DIN | DVP_D3 | Audio data input or camera data input 3 |
+| GPIO16 | 39 | I2S_MCLK | DVP_D4 | Audio master-clock output or camera data input 4 |
+| GPIO17 | 40 | I2S_REFCLK_IN | DVP_D5 | Audio reference or camera data input 5 |
+| GPIO18 | 41 | PWM0 | DVP_D6 | PWM output 0 or camera data input 6 |
+| GPIO19 | 42 | PWM1 | DVP_D7 | PWM output 1 or camera data input 7 |
+| GPIO20 | 43 | PWM2 | DVP_PIXCLK | PWM output 2 or raw pixel-clock input |
+| GPIO21 | 44 | PWM3 | DVP_HREF | PWM output 3 or camera HREF input |
+| GPIO22 | 45 | PWM_FAULT | DVP_VSYNC | PWM fault or camera VSYNC input |
+| GPIO23 | 46 | PWM_SYNC | CAM_XCLK | PWM sync input or shared divided clock output |
 | GPIO24 | 51 | PWM_CAP0 | UART0_TX | PWM capture 0 or alternate UART TX |
 | GPIO25 | 52 | PWM_CAP1 | UART0_RX | PWM capture 1 or alternate UART RX |
 | GPIO26 | 11 | WS2812_OUT | I2C0_SCL | LED output or alternate open-drain I2C clock with readback |
@@ -303,6 +344,45 @@ leaves 16. Including SD card detection/power and four PWM outputs uses 22 and
 leaves 10. WS2812 and the alternate I2C SCL route on GPIO26 are mutually
 exclusive; the default I2C route on GPIO10/11 remains available.
 
+### Camera profile and board ownership
+
+GPIO12-23 ALT1 forms one camera profile: DVP_D0-7, DVP_PIXCLK, DVP_HREF,
+DVP_VSYNC and CAM_XCLK. The eleven DVP inputs use raw pads, not GPIO filters;
+CAM_XCLK is a SoC clock output, not a new port or clock inside the shared DVP
+IP. Camera and I2S profiles MUST be mutually exclusive. Camera use also
+excludes the default PWM outputs/fault/sync on GPIO18-23. No old ALT0 or other
+ALT1 assignment is removed; giving up UART/I2C for alternate PWM routes is
+not part of the concurrent camera configuration.
+
+| Function | Camera-profile GPIO allocation | Count |
+| --- | --- | ---: |
+| DVP inputs and CAM_XCLK | GPIO12-23 ALT1 | 12 |
+| 4-bit SDIO | GPIO0-5 ALT0 | 6 |
+| UART0 | GPIO8-9 ALT0 | 2 |
+| Sensor control through I2C0 | GPIO10-11 ALT0 | 2 |
+| WS2812 | GPIO26 ALT0 | 1 |
+| XPI PSRAM NSS1 | GPIO29 ALT0 | 1 |
+| Subtotal | Non-overlapping required routes | 24 |
+| Optional SD detect/power | GPIO6-7 ordinary GPIO | 2 |
+| Optional camera RESET_N/PWDN | GPIO24-25 ordinary GPIO | 2 |
+| Total with optional controls | 28 distinct GPIO | 28 |
+| Remaining ordinary GPIO | GPIO27, GPIO28, GPIO30, GPIO31 | 4 |
+
+GPIO24/25 controls replace their PWM capture/alternate UART use while selected;
+they are board assignments, not DVP register or protocol ports. Sensor control
+must verify its I2C/SCCB compatibility and reset/power timing. Default UART0,
+I2C0, SDIO and WS2812 remain available with the camera. Independent boot XPI
+pins and JTAG remain unchanged. GPIO28 is ordinary GPIO in this count; selecting
+its CLKOUT route consumes it and mirrors the same generator as CAM_XCLK.
+
+Before changing profiles, stop capture/audio/PWM, drain associated DMA and
+accepted traffic, disable clock outputs and release pad drivers. Board wiring
+MUST keep inactive camera/codec outputs high impedance, use alternative
+assembly, or provide external isolation. An internal pinmux cannot prevent
+two external devices from driving a shared net. Camera and PSRAM voltage/load
+requirements must match the fixed 3.3 V IO rail or use qualified board-level
+translation; this profile does not add supplies or pads.
+
 ## Shared IP and product-specific integration
 
 The selected hierarchy is `retrosoc_tiny` plus a Tiny-owned RCU/SYSCTRL,
@@ -326,6 +406,7 @@ linked common contract; do not generate a second set of IP registers.
 | Crypto V2 | `0x1000C000` | 23 | [Crypto](crypto.md), AES/SHA/RSA, central DMA channels 4/5 |
 | Tiny RCU/SYSCTRL | `0x1000B000` | 31 | Tiny-owned control bank; one decoder, shared legacy terminal/fault entrypoints |
 | I2S | `0x10007000` | 8 | [I2S](i2s.md), common host ABI and audio CDC; Tiny DMA channels 6/7 |
+| DVP V2 | `0x1000E000` | 15 | [DVP](dvp.md), existing APB4/32-bit stream ABI, `DVP_RX=11`, Tiny DMA channel 2 |
 | SDIO0 | `0x1000F000` | 10 | [SDIO](sdio.md), one host and its private AXI32 DMA master |
 | Central DMA | `0x1000A000` | 20 | [DMA V2](dma.md), eight channels and supported request discovery |
 
@@ -348,25 +429,32 @@ private DMA request; software finishes the CRC session after DMA completion.
 | ---: | --- |
 | 0 | UART0 |
 | 1 | I2C0 |
-| 2 | General memory transfers |
+| 2 | DVP receive; general memory transfers only when camera ownership is released |
 | 3 | Serialized bulk clients: XPI, WS2812 and CRC |
 | 4 | Crypto input |
 | 5 | Crypto output |
 | 6 | I2S transmit |
 | 7 | I2S receive |
 
-Retain Crypto request IDs 12/13 and I2S request IDs 1/2. Channel ownership is
-product integration data, not a different DMA register ABI. In particular,
+Retain Crypto request IDs 12/13, I2S request IDs 1/2 and DVP request ID 11.
+Channel ownership is product integration data, not a different DMA register
+ABI. In particular,
 Tiny channel 6 is not Mini's HP-boot reservation. Shared drivers use product
 assignments rather than assuming all products give the bulk channel to I2S.
 Channel 3 clients must serialize ownership and fail boundedly when unavailable.
+Channel 2 is reserved for the camera session through capture and final DMA
+drain; memory clients must not steal it. DVP is a stream source, not a fourth
+AXI master. Writing its stream to XPI mapped RAM still uses `DVP_RX`, not an
+XPI indirect TX request or a CPU whole-frame staging buffer.
 
 Retain the common DMA direct/TCD ABI, 32-bit Tiny datapath, at-most-16-beat
 memory bursts, completion/error/W1C and abort-drain behavior. Replace the
 baseline's blanket Tiny stream rejection with truthful endpoint capabilities;
-omitted I2C1/DVP requests remain unsupported. Enable Crypto and I2S streams in
-PCLK, without adding CDC inside either shared stream contract. Existing
-request thresholds and cross-domain XPI completion/request signals require
+omitted I2C1 requests remain unsupported. P7 reserves DVP routing but MUST NOT
+advertise request 11 until P12 connects the IP and stream. Enable implemented
+Crypto, I2S and DVP host streams in PCLK, without adding CDC inside the shared
+stream contracts. Existing request thresholds and cross-domain XPI
+completion/request signals require
 proper synchronization/handshake at the product boundary.
 
 CPU and the two DMA masters share Tiny's globally active read-or-write
@@ -407,6 +495,159 @@ controller. The deterministic regression source remains `qualified=0`;
 security-facing reads retain the shared HAL's unsupported/fail-closed result
 until a physical source and its qualification are supplied.
 
+## DVP capture and XPI framebuffer contract
+
+### Reused IP and integration boundary
+
+[DVP V2](dvp.md) is the sole normative register/format/stream contract. Tiny
+retains `IP_VERSION=0x00020000`, the 4 KiB APB4 window, register offsets,
+access/reset/W1C semantics, error/statistic registers, interrupt composition,
+polarity controls and sampling-edge selection. CPU IRQ15 carries its enabled
+interrupt level. Do not duplicate or reinterpret the shared register map in
+Tiny; preserve the handwritten RTL/C definition parity and Mini compatibility.
+
+The existing `axi4s_dvp` owns the 8-bit pixel input, RGB565/YUV422 packing,
+configuration/command/statistic handshakes and 128-entry CDC FIFO. Payload
+capacity is 512 bytes; sidebands do not provide additional pixel storage.
+The output is a 32-bit AXI4-Stream with `TUSER[0]=SOF`, `TLAST=EOL`, and
+existing `TKEEP/TSTRB` semantics. Two 16-bit pixels form a full word; an odd
+output line ends in a half word. The shared DMA accepts full words only, so
+DMA capture requires an even active width (crop width when enabled). Odd
+width remains available through the existing PIO path, not a new Tiny DMA
+packing mode. `TLAST` is diagnostic line state, not DMA frame termination.
+
+```mermaid
+flowchart LR
+    camera["DVP inputs / external PIXCLK"] --> dvp["Shared DVP / existing CDC FIFO"]
+    dvp -->|"32-bit stream / PCLK"| dma["Central DMA channel 2"]
+    dma -->|"AXI CDC"| fabric["Three-master AXI32 / SYS"]
+    fabric -->|"AXI CDC"| xpi["Shared XPI / MEM"]
+    xpi -->|"NSS1 + existing SCK/D0-3"| ram["Optional PSRAM framebuffer"]
+```
+
+DVP control and stream run in PCLK. GPIO20 ALT1 supplies the independent raw
+pixel clock through the IP's existing buffer/inverter/mux and five-edge reset
+synchronizer. Reuse `cdc_2phase` for configuration/commands/statistics and
+`cdc_fifo_warm_flush` for payloads. The camera cannot obey AXI backpressure:
+FIFO exhaustion invalidates the frame, even when PSRAM has enough free space.
+Do not increase FIFO depth or change the shared CDC topology in this scope.
+
+### XPI device and memory ownership
+
+Use [XPI V2](xpi.md) NSS1 with GPIO29 ALT0 (QFN pin 14), sharing the dedicated
+SCK/D0-3 wires with boot NOR on NSS0. The NSS1 aperture is
+`0x54000000..0x57FFFFFF` (64 MiB), not a promise of fitted RAM capacity. The
+reference verification geometry is the existing 8 MiB ESP-PSRAM64H model,
+currently `rtl/mini/dv/model/ESP_PSRAM64H.sv`: its valid mapped data range is
+`0x54000000..0x547FFFFF`. P11 must place any reused device model under shared
+or Tiny-owned verification ownership without importing Mini product RTL or
+copying the separate `apb4_psram` controller. Model reuse alone does not
+qualify a physical part, board or XPI path.
+
+P11 MUST validate the selected device identity, actual geometry, SPI/QPI SDR
+initialization and reset commands, mapped read/write LUTs, dummy cycles, SCK,
+CS setup/hold/high times, maximum active-CS duration and serial boundaries.
+Publish a supported device/profile only after CPU and central-DMA readback
+pass. No DDR/OPI/HyperBus, extra controller or new memory window is selected.
+
+PSRAM is optional application data storage. NOR boot and SRAM-only firmware
+must work with it absent, uninitialized or failing. Code, vectors and stack
+stay in the 128 KiB SRAM; no automatic external heap/linker allocation or
+external-RAM boot dependency is introduced. Validate capacity before making
+a buffer available. While reconfiguring XPI, all executing firmware and
+interrupt paths must be SRAM-resident and other XPI users quiesced. Preserve
+NSS0's read-only boot alias, mapped-write disable and boot LUT; allocate the
+PSRAM configuration without overwriting NOR sequences. GPIO29 needs an
+external inactive-high bias before its alternate output is enabled.
+
+Mapped writes require the slot's explicit write-enable and correct write LUT.
+They are ordinary central-DMA AXI destination writes, not writes to XPI
+`TXDATA` or use of its indirect DMA request. XPI still has one physical engine:
+serial commands are not preempted, and indirect/polling commands can block
+mapped requests. No additional master or hidden RAM cache is introduced.
+
+### Frame allocation and transfer limits
+
+For both supported formats, the packed frame length is `2 * active_W * active_H`
+bytes; use the cropped output dimensions when cropping. Calculate with checked
+arithmetic before narrowing to the DMA count. Sensor format/dimensions and
+crop bounds must satisfy the existing DVP contract.
+
+| Example output | Frame bytes | KiB | Exact DMA word count |
+| --- | ---: | ---: | ---: |
+| 160 x 120 (QQVGA) | 38400 | 37.5 | 9600 |
+| 320 x 240 (QVGA) | 153600 | 150 | 38400 |
+| 640 x 480 (VGA) | 614400 | 600 | 153600 |
+
+These are storage examples, not guaranteed capture modes or frame rates. An
+internal-SRAM buffer is legal only after firmware/stack/other data budgets fit;
+external storage permits a whole frame larger than 128 KiB. Resolution is
+bounded by the unchanged IP/sensor format, actual allocation and measured
+transport, not a QQVGA-only rule.
+
+The transport MUST check nonzero dimensions, even active width for DMA,
+word-aligned destination, allocation capacity, address-addition overflow and
+the complete range against the initialized device end. Prefer 64-byte-aligned
+frame bases. Program the exact frame byte count, not the allocation's spare
+capacity. Select a burst maximum of at most 16 words that satisfies device
+serial boundaries and maximum CS duration at the chosen SCK, including
+command/address/dummy overhead. DMA enforces 4 KiB limits; it does not infer
+the PSRAM serial boundary. XPI rejects a crossing transaction rather than
+automatically splitting every illegal request. Use a proven alignment/burst
+combination or smaller bursts, and reject unsupported combinations before
+capture. Do not add stride, descriptors or rings to bypass these checks.
+
+The shared HAL currently binds its convenience helper to bulk channel 3,
+uses maximum bursts, and programs `word_capacity * 4` as the transfer length.
+P12 must supply channel 2 and validated memory/burst limits through product
+configuration/shared transport code, retaining Mini's channel-3 default and
+the public DVP ABI. It may compose the existing `rs_dvp_*`/`rs_dma_*` APIs;
+it MUST NOT copy a Tiny-only DVP driver or silently change capacity semantics.
+Pass the exact frame word count after separately validating allocation capacity.
+Keep the SDK freestanding and bounded, with deterministic tests for range and
+length validation and the existing `fence rw,rw` DMA ownership rules.
+
+### Completion, recovery and bandwidth acceptance
+
+Reserve DMA2 and the frame buffer, configure the inactive DVP and initialized
+XPI target, clear stale status, arm the exact DMA length and stream, then
+start snapshot capture. Software may publish a valid buffer only after all
+of the following agree: DVP frame-done/statistics, DMA done with exact
+`bytes_done`, all destination write responses completed, and zero DVP/DMA/XPI
+error. A frame IRQ or final input pixel alone is not completion.
+
+On success, keep the stream/FIFO available until the final DMA word drains.
+The current helper calls abort before waiting for DMA after frame-done; P12
+must test delayed final-word/write-response cases and correct shared ordering
+if necessary before claiming integration acceptance. Do not redefine the IP's
+abort/flush behavior to conceal a transport issue. Clear/rearm only after a
+completed frame or bounded failure cleanup; test repeated snapshots explicitly.
+
+Overflow, sync/size/partial/config errors, DMA or XPI errors, abort, lost pixel
+clock, timeout or interrupted reset invalidate the whole destination buffer.
+Retain DVP counters/errors, DMA progress/first-error state and XPI's sticky
+error address/slot for diagnosis before W1C cleanup. Abort capture, drain or
+abort accepted DMA/AXI work with bounded waits, then flush/reset/rearm using
+the shared lifecycle. Never claim a valid partial image or successful reset
+when a required clock/barrier acknowledgement is missing. Recovery that needs
+a system reset must mark the session lost, not silently resume stale data.
+
+P11 must measure mapped-write payload throughput and longest backpressure at
+each supported clock/device profile. P12 selects sensor prescalers/PIXCLK
+against those results, blanking behavior and the existing 512-byte payload
+FIFO. CAM_XCLK defaults to REF24 divided by two (12 MHz), but the sensor's
+PIXCLK need not equal XCLK and 12 MHz PIXCLK is not prequalified. During MVP
+capture, exclude NOR program/erase, XPI indirect/polling/reconfiguration and
+other traffic whose blocking time exceeds the tested budget. Read back or save
+the completed frame through SDIO only after capture; add contention/error
+stress to verification without promising unrestricted concurrent throughput.
+
+The MVP is single-buffer snapshot/crop with full readback and guard checks.
+Existing continuous-mode capability remains unchanged, but lossless continuous
+capture/FPS, a chosen physical sensor/PSRAM part and board timing are deferred
+qualification items. This buffer path adds no memory protection, IOMMU,
+authenticated image source or security/safety certification.
+
 ## Gen1 clock, reset and board requirements
 
 ### Sources, domains and operating profiles
@@ -442,6 +683,8 @@ flowchart TD
     sys --> pclk["PCLK divider: central DMA and shared peripherals"]
     ref --> tick["/24 enable: 1 MHz CLINT timebase"]
     audio["GPIO17 reference or codec clocks"] --> i2s["AUDIO: I2S PHY"]
+    ref --> camclk["Shared CLKOUT /2: CAM_XCLK on GPIO23 ALT1"]
+    pixel["GPIO20 ALT1: external PIXCLK"] --> dvp["PIXCLK: shared DVP pixel path"]
     tck["JTAG_TCK"] --> dtm["TAP / DTM"]
 ```
 
@@ -455,8 +698,9 @@ remain clocked while XIN runs and MUST NOT be software-gated.
 | AON / REF24 | RCU, CLINT, ArchInfo; RTC/WDG functional clocks | 24 MHz | 24 MHz | 24 MHz | 24 MHz |
 | SYS | CPU/AHB adapter, AXI32 fabric, SDIO including its APB and private DMA | 24 MHz | 96 MHz | 192 MHz | 240 MHz |
 | MEM | Main SRAM and XPI, including their control interfaces | 24 MHz | 96 MHz | 96 MHz | 120 MHz |
-| PCLK | Eight-channel DMA, GPIO, UART0, I2C0, timers, PWM, RNG, CRC, WS2812, Crypto, I2S host; RTC/WDG APB | 24 MHz | 48 MHz | 48 MHz | 60 MHz |
+| PCLK | Eight-channel DMA, GPIO, UART0, I2C0, timers, PWM, RNG, CRC, WS2812, Crypto, I2S/DVP hosts; RTC/WDG APB | 24 MHz | 48 MHz | 48 MHz | 60 MHz |
 | AUDIO | I2S audio PHY and existing audio-side FIFOs | External | External | External | External |
+| PIXCLK | DVP pixel path and existing pixel-side FIFO | External | External | External | External |
 | JTAG | TAP/DTM | Separate TCK | Separate TCK | Separate TCK | Separate TCK |
 
 The no-PLL fast row assumes XIN=96 MHz; XIN=48 MHz produces SYS/MEM/PCLK of
@@ -492,6 +736,16 @@ requires a common-IP extension and common driver contract, not a Tiny-only
 register reinterpretation. Missing audio clocks must cause bounded operation
 failure, never prevent CPU boot or hold an APB transaction indefinitely.
 
+The camera profile uses the existing RCU CLKOUT source REF24 and half-period
+divisor 1, producing CAM_XCLK=12 MHz independently of SYS changes. Reset leaves
+the generator off; software enables it only after safe board/route setup.
+GPIO23 ALT1 and GPIO28 ALT0 are two routes of this one generator, not
+independently programmable clocks. If both are selected they mirror one rate.
+The sensor returns PIXCLK on GPIO20; its clock must remain within separately
+validated DVP/Pad and transport limits. Missing/stopped PIXCLK must not block
+CPU boot or ordinary APB completion. Host-side waits return bounded failure;
+the pixel domain may stay in reset until its clock and restart barriers return.
+
 ### CDC, clock reporting and gating
 
 | Crossing | Required mechanism |
@@ -499,8 +753,9 @@ failure, never prevent CPU boot or hold an APB transaction indefinitely.
 | Central DMA PCLK AXI to SYS | Complete AXI channel CDC with preserved payload/ordering and reset barriers |
 | SYS to SRAM/XPI MEM | AXI request/response CDC; control access uses the MEM-domain APB endpoint |
 | SYS control to PCLK/AON/MEM APB | Stable full request/response handshakes, byte strobes and propagated errors |
-| Crypto/I2S host streams to central DMA | Same PCLK; no added internal stream CDC |
+| Crypto/I2S/DVP host streams to central DMA | Same PCLK; no added internal stream CDC |
 | I2S host to AUDIO | Shared IP configuration handshake and warm-flush sample FIFOs |
+| DVP host to PIXCLK | Existing configuration/command/statistic `cdc_2phase` handshakes, `cdc_fifo_warm_flush` and five-edge pixel reset release |
 | JTAG to debug logic | Existing Hazard3 DMI asynchronous bridge and debug-reset handshake |
 | IRQ/status, XPI DMA request/completion | Level synchronizers or acknowledged event/snapshot transfer; no raw pulse or multi-bit sampling |
 
@@ -531,7 +786,7 @@ are not ordinary software-gate targets.
 ### Clock transition and failure protocol
 
 1. The product clock service runs from SRAM and disables/quiesces all
-   frequency-sensitive clients. DMA streams, SDIO/XPI, UART/I2C, I2S/PWM,
+   frequency-sensitive clients. DMA streams, SDIO/XPI, UART/I2C, I2S/DVP/PWM,
    WS2812, CRC sessions, RNG source handshakes and Crypto maintenance must
    be idle. Pending GPIO/filter use must be made safe by its owner.
 2. Accept and acknowledge the RCU command before blocking new AXI admissions.
@@ -550,6 +805,14 @@ are not ordinary software-gate targets.
    state together, then unblock transactions. Software reprograms dependent
    timing before re-enabling the clients.
 
+Before changing camera routes, PIXCLK sampling polarity, PCLK, DVP gating or
+the CLKOUT generator, stop capture and drain DMA2. Complete normal abort/flush
+handshakes while the sensor PIXCLK is still running; only then disable
+CAM_XCLK or put the sensor into reset/power-down. On missing-clock timeout,
+invalidate the frame and hold/restart the pixel domain without fabric or CPU
+deadlock. Do not acknowledge a successful peripheral reset until its required
+local edges and CDC barriers actually complete.
+
 BUSY distinguishes the transition interval from a committed operating point.
 No client may configure timing from rate readbacks while BUSY is set. If PLL
 programming has started and lock fails, complete the fallback to the entire
@@ -594,12 +857,13 @@ Use asynchronous assertion and five valid destination-clock edges for each
 reset synchronizer's release. On system reset, force pad-safe states and
 block new traffic; release REF24/RCU, then validated SYS/MEM/PCLK domains and
 their bus/reset barriers, and only then release the CPU. Keep a missing-clock
-AUDIO domain in reset without blocking the CPU or the I2S host register bank.
+AUDIO or PIXCLK domain in reset without blocking the CPU or the corresponding
+host register bank.
 Source/destination reset acknowledgements must prevent stale CDC data from
 crossing a new session. External reset must not depend on a clock edge to assert.
 
 The CPU must be able to initialize Crypto after boot. Therefore CPU release
-does not wait for Crypto READY, table loading or an external audio clock.
+does not wait for Crypto READY, table loading or an external audio/pixel clock.
 Main SRAM is not cleared by reset. Crypto immediately revokes keys/results and
 valid state, then completes its shared physical scrub/readback on running
 PCLK before initialization or successful erasure reporting. Keep its clock
@@ -624,6 +888,8 @@ response that system reset deliberately discarded.
 | TEST_MODE | External pull-down selects 0 | Reserved for manufacturing test, not ordinary GPIO |
 | JTAG | Dedicated debug access remains available | Application pinmux must not disconnect the debug path |
 | GPIO7 / SD_PWR_EN | External pull-down keeps card power disabled | Drives a load-switch enable, never the SD card supply directly |
+| GPIO29 / XPI_CS1_N | High impedance until selected; PSRAM remains deselected | External pull-up; no PSRAM dependency during NOR boot |
+| GPIO23 / CAM_XCLK and GPIO24/25 controls | No clock output after reset; ordinary GPIO high impedance | Board-defined sensor reset/power-down bias and inactive-device isolation |
 
 The current IHP GPIO binding provides no internal pull-up/down capability;
 required reset, boot, test and bus bias must not rely on internal resistors.
@@ -671,7 +937,7 @@ reachable through an acknowledged APB bridge while the system is running.
 | `0x14C` | `MEM_HZ` | RO / 24000000 | Committed MEM frequency |
 | `0x150` | `PCLK_HZ` | RO / 24000000 | Committed peripheral frequency |
 | `0x154` | `CLINT_HZ` | RO / 1000000 | CLINT tick rate |
-| `0x158` | `TARGET_CAPABILITY` | RO / `0x00003FFF` | Implemented gate targets; reset excludes CPU bit 0 |
+| `0x158` | `TARGET_CAPABILITY` | RO / build-dependent | Implemented gate targets; `0x00003FFF` before DVP integration, `0x00007FFF` when all Gen1 targets exist; reset excludes CPU bit 0 |
 | `0x15C` | `CLKOUT_CONTROL` | RW / 0 | Source `[2:0]`; half-period divisor `[23:8]`; output is off after reset |
 
 Clock profile 0 is SAFE24. Profile 1 is external XIN at its declared frequency
@@ -687,7 +953,11 @@ identity and manifest must identify the model rather than physical qualification
 
 The target-mask bits are Tiny integration identifiers, not Mini register ABI:
 0 CPU, 1 GPIO, 2 UART0, 3 I2C0, 4 timer0, 5 timer1, 6 PWM, 7 I2S, 8 SDIO,
-9 central DMA, 10 WS2812, 11 RNG, 12 CRC and 13 Crypto. Other bits are reserved.
+9 central DMA, 10 WS2812, 11 RNG, 12 CRC, 13 Crypto and 14 DVP. Bits 15-31
+are reserved. Bit 14 is an additive target allocation; existing offsets/bits
+and RCU ABI 1.0 semantics remain unchanged. P8 may reserve the control plumbing
+but MUST report bit 14 clear and reject its commands until P12 instantiates
+the complete DVP idle/reset/CDC path. No capability is inferred from a tie-off.
 CPU gating means permission to gate only while WFI/idle with no pending IRQ or
 debug request; it is not an immediate software stop. RCU/REF24, AXI, main
 SRAM, XPI, CLINT, ArchInfo and RTC/WDG functional clocks cannot be gated or
@@ -715,7 +985,10 @@ CLKOUT sources 0-4 mean off, REF24, SYS, MEM and PCLK. Other values are invalid.
 An enabled output requires a nonzero half-period divisor and a resulting
 frequency no greater than the 24 MHz planning limit, subject to Pad signoff.
 Change source/divisor only while the output is disabled and RCU is idle;
-CLOCK_APPLY requires CLKOUT disabled. GPIO28 ALT0 remains the only route.
+CLOCK_APPLY requires CLKOUT disabled. Preserve GPIO28 ALT0 and add GPIO23
+ALT1 as CAM_XCLK; both route this same generator. The default camera source is
+REF24 with divisor 1 (12 MHz). Stop/drain the sensor capture before disabling
+the generator, even when REF24 itself would not change during CLOCK_APPLY.
 
 The product-selected Tiny backend must expose bounded clock-profile,
 clock-snapshot, gate, peripheral-reset, reset-cause and fault operations using
@@ -728,8 +1001,9 @@ offsets. A running hardware clock is still required for any software timeout.
 ## Deferred physical and shared-IP prerequisites
 
 Addresses, DMA/IRQ assignments and the clock/reset behavior above are frozen
-targets. Implementation and physical acceptance remain P7-P9 work. The
-following prerequisites are not evidence of completed platform support:
+targets. Implementation proceeds through P7/P8/P11/P12 and physical acceptance
+remains P9 work. P10 is documentation-only. The following prerequisites are
+not evidence of completed platform support:
 
 | Item | Required follow-up and boundary |
 | --- | --- |
@@ -737,6 +1011,8 @@ following prerequisites are not evidence of completed platform support:
 | Shared PWM clock reporting | Upgrade through the locked upstream flow, preserving CLOCK_HZ meaning and common HAL, and adapt/test existing consumers before variable PCLK is enabled. |
 | I2S slave extension | Freeze the common IP/driver extension before implementing slave mode. P7 may integrate the existing master path; no completed slave-mode or full Gen1 release claim follows from that subset. |
 | Alternate input routing | Preserve the P5 exclusive UART/I2C route requirement. Product route-register encoding and conflict reporting must be frozen before those remaps are implemented; no OR of competing pad inputs is allowed. |
+| XPI PSRAM transport | P11 must validate NSS1 geometry, initialization/LUT, CPU/DMA mapped writes, serial/CS boundaries, recovery and throughput with a real pin-level model. The separate PSRAM-controller tests and fast NOR backend are not this evidence. |
+| DVP integration and board profile | P12 must connect the shared IP unchanged, bind DMA2, verify final-word drain and missing-clock recovery, and isolate inactive camera/audio board drivers. Select physical sensor/PSRAM parts and qualify 3.3 V compatibility/Pad timing before rate claims. |
 | Boot and manufacturing test | Nonzero BOOT_MODE behavior, detailed strap sampling and TEST_MODE manufacturing entry remain a separate contract; no UART download ROM is implied. |
 | Entropy and security | Supply and characterize the physical entropy source before qualified RNG use; crypto acceleration does not establish secure boot or side-channel certification. |
 | Package and physical release | Confirm EP connection, analog supply/loop-filter assumptions, outline/bonding, IO drive/load, power integrity and PVT/post-layout timing without changing the QFN64 pad budget. |
@@ -839,6 +1115,23 @@ TINY-P5 records the 2026-09-26 product/package refreeze. TINY-P6 below is the
 2026-09-30 shared-IP and clock/reset refreeze that supersedes its 144 MHz and
 four-channel target assumptions. All phases target TINY; changes to shared
 consumers require Mini compatibility validation, not a Mini feature rollout.
+P10 records the 2026-10-01 camera/framebuffer refreeze. Preserve all P0-P9
+IDs/titles and their historical status; do not infer qualification or completed
+implementation from a documentation milestone.
+
+| Remaining execution order | Stable phase ID and title | Dependency / completion boundary |
+| ---: | --- | --- |
+| 1 | TINY-P10 - DVP and XPI Framebuffer Contract Refreeze | Approved P6 plus camera package; documentation only |
+| 2 | TINY-P7 - Shared IP and Eight-Channel DMA Integration | P10; 24 MHz platform/shared-IP integration, DVP capability still absent |
+| 3 | TINY-P8 - Tiny RCU and Dual-Mode Clock/Reset Integration | P7 and shared PWM reporting; camera clock route and reserved DVP control plumbing |
+| 4 | TINY-P11 - XPI PSRAM Framebuffer Bring-up | P7/P8; functional NSS1 mapped-RAM acceptance and measured transport budget |
+| 5 | TINY-P12 - DVP Camera Profile and Frame Capture Integration | P10/P11 and P8 clock/reset infrastructure; end-to-end snapshots/crops |
+| 6 | TINY-P9 - Gen1 Verification and Physical Qualification | P7/P8/P11/P12 and named shared-IP/physical prerequisites |
+
+Phase numbers are stable identifiers, not chronological execution order.
+P0-P6 retain their recorded scope and gaps; this table does not mark them all
+complete. Each implementation phase below must run the applicable validation
+entrypoints and record its exact source/profile/PDK, even when reusing an IP.
 
 ### TINY-P0 — Freeze Tiny MCU Contract
 
@@ -908,8 +1201,9 @@ metric policy or generated datasheet changes belong to P6.
 
 ### TINY-P7 - Shared IP and Eight-Channel DMA Integration
 
-Start from the committed IHP130 Tiny profile at its 24 MHz safe clock. Add the
-four shared peripheral instances, eight-channel DMA and common streams,
+Depends on the P10 refreeze. Start from the committed IHP130 Tiny profile at
+its 24 MHz safe clock. Add the four shared peripheral instances, eight-channel
+DMA and common streams,
 three-master AXI32 integration, address/IRQ/capability generation, Crypto's
 private banks/initialization, common HAL composition and GPIO26 WS2812 route.
 Integrate existing I2S master and SDIO contracts with their target routes;
@@ -917,6 +1211,9 @@ unresolved shared I2S slave and alternate-input-remap extensions retain their
 explicit prerequisite boundaries above. Do not advertise unimplemented modes.
 Tiny's new dynamic RCU bank/clock domains belong to P8; P7 software must not
 pretend those controls already exist.
+Reserve DMA2/request 11 for P12 and retain unsupported capability/error
+behavior until the DVP source exists. This phase does not include DVP capture,
+PSRAM qualification or extra masters/channels; keep its default audio routes.
 
 This phase changes implemented addresses, DMA count/ownership, IRQs, pad
 routing and capabilities. Keep the safe-clock reference profile, source
@@ -936,6 +1233,11 @@ Tiny-owned RCU/SYSCTRL bank/backend, REF24 normalization, safe boot, no-PLL
 commit, domain bridges, gates and reset/CDC barriers. Maintain handwritten
 RCU register parity and unchanged shared peripheral drivers. This phase
 changes register ABI, clocks, reset ownership and CDC/RDC behavior.
+Add the GPIO23 ALT1 CAM_XCLK route of the existing CLKOUT generator without
+removing GPIO28 ALT0, and reserve DVP target bit 14 for P12. Until the IP is
+instantiated, its target/request capability stays clear and operations fail
+as unsupported. Test shared-output selection, off-on-reset and REF24/2 rate;
+full sensor/PIXCLK acceptance belongs to P12.
 
 Add explicit committed configurations for the new functional cases through
 the existing configuration flow; they do not exist merely because this
@@ -954,7 +1256,7 @@ software parity/host tests, source/style checks and affected Mini regressions.
 
 ### TINY-P9 - Gen1 Verification and Physical Qualification
 
-Depends on P7/P8 and the required physical inputs. Qualify both no-PLL and
+Depends on P7/P8/P11/P12 and the required physical inputs. Qualify both no-PLL and
 PLL targets using reviewed source revisions and explicit profiles. Complete
 Tiny firmware/regression, synthesis/netlist/STA, CDC/RDC, Pad and package
 constraints, power/reset distribution and relevant PVT/post-layout checks.
@@ -967,6 +1269,110 @@ Report coverage separately for the 24 MHz baseline, no-PLL 96 MHz and PLL
 PLL macro, failed timing result or unimplemented prior Gen1 requirement is a
 named delivery gap, not a passing qualification. P9 cannot imply complete
 Gen1/slave-audio/boot-mode support while those prerequisites remain open.
+Include camera versus audio pad profiles, pixel-clock input timing/CDC/RDC,
+CAM_XCLK load/edges, XPI NOR/PSRAM shared-bus turnaround and CS timing,
+device/sensor/level compatibility, simultaneous IO switching and unchanged
+package/power counts. Archive per-profile camera/PSRAM throughput and error
+coverage separately from physical signoff. Existing DVP continuous mode alone
+does not qualify continuous video.
+
+### TINY-P10 - DVP and XPI Framebuffer Contract Refreeze
+
+Target SoCs: TINY. Depends on the approved P6 contract and camera research.
+Freeze TINY-021 through TINY-027, GPIO12-23 ALT1, shared CAM_XCLK routing,
+DVP base/IRQ/request/DMA2, optional NSS1 PSRAM data storage, exact frame-length
+and tail-drain rules, RCU target 14 and the dependency order above. Update
+the main specification, verification record and relevant integration indexes.
+This phase changes the specified product pinmux/capability/lifecycle contract,
+not the shared DVP ABI or the implemented hardware/software interface.
+
+Acceptance: preserve all P0-P9 headings verbatim; compare the 64-pin perimeter
+and power table against P6; verify 32 GPIO rows, exactly twelve new ALT1
+assignments and no other alternate changes; check 28 distinct camera-profile
+GPIO with optional controls; check common address/IRQ/request values, buffer
+arithmetic, RCU bit allocations, links and documented commands; run
+`git diff --check`. No RTL, HAL, build configuration, dependency, warning
+baseline, metrics policy or generated datasheet changes belong to P10. This
+freeze supplies no new hardware or physical acceptance result.
+
+### TINY-P11 - XPI PSRAM Framebuffer Bring-up
+
+Target SoCs: TINY, initially IHP130. Depends on P7/P8. Implement optional
+board/device selection and bounded PSRAM initialization through the shared
+XPI HAL, NSS1/GPIO29 routing, correct LUT/timing/geometry and frame-storage
+validation. Reuse the ESP-PSRAM64H behavioral geometry under an appropriate
+verification owner; do not add the separate PSRAM controller or a dependency
+on Mini product RTL. Introduce committed test configurations through the
+normal profile flow, not assumed names. Keep boot/code/stack/vectors in SRAM,
+NSS0 NOR mapped writes disabled and external RAM optional.
+
+The public change is product support/configuration for an existing XPI slot,
+not a new XPI register ABI, address window, DMA request or AXI master. Reuse
+and test shared HAL behavior on Mini if transport fixes are required. No DVP
+hardware capture is claimed in this phase. Validate CPU and DMA mapped writes
+with complete readback/CRC and guards, device-end/4 KiB/serial boundaries,
+legal burst lengths/CS duration, absent/wrong-device/timeout recovery,
+reinitialization, and unchanged NOR boot/data. Run actual pin-level PSRAM in
+both simulators, not the fast-flash backend or separate-controller acceptance.
+
+Acceptance: the validation entrypoints below pass for each implemented
+clock/device profile, including the 24 MHz baseline and P8 profiles to be
+advertised; firmware reports strict terminal success. Record source/profile,
+device settings, payload throughput and worst write-backpressure interval for
+P12's PIXCLK budget. Missing physical device/Pad evidence remains a P9 gap,
+not a supported-frequency claim.
+
+### TINY-P12 - DVP Camera Profile and Frame Capture Integration
+
+Target SoCs: TINY, initially IHP130. Depends on P10/P11 and P8 infrastructure.
+Instantiate the existing DVP, APB/IRQ15 and PCLK stream-to-DMA2/request 11,
+raw GPIO12-22 camera inputs, GPIO23 CAM_XCLK, RCU target 14 and existing
+pixel CDC/reset. Publish endpoint/target capability only when connected.
+Implement camera/audio profile ownership, optional sensor control and shared
+HAL product binding; preserve Mini defaults, DVP V2 registers and FIFO size.
+This phase changes implemented Tiny pinmux, peripheral capability, clock/reset
+inventory and DMA ownership, not a shared IP register ABI or master count.
+
+Acceptance: execute existing DVP tests and new end-to-end
+DVP -> DMA -> AXI -> XPI -> PSRAM pin-level tests in both simulators. Exercise
+RGB565/YUV422, repeated snapshots, crop output, full QVGA/VGA-size external
+buffers at a measured safe input rate, and small SRAM capture when its full
+budget fits. Check every frame byte and buffer guards, exact counters, IRQs,
+delayed final-word/write-response drain, even-width DMA and odd-width PIO.
+Reject odd-width DMA/insufficient buffers before capture. Cover backpressure,
+overflow, sync/partial errors, device/boundary failures, stopped-high/low or
+absent PIXCLK, reset/abort/rearm, audio/camera mode transitions and preserved
+NOR boot. Firmware must not publish a frame before all completion conditions.
+
+Run the validation entrypoints below, affected shared-HAL/Mini regressions and
+negative capability tests. Keep the first workflow capture-then-readback/save;
+continuous high-rate delivery, a physical sensor driver/board operating point
+and final IO/clock signoff remain explicit P9 or later qualification work.
+
+### Implementation validation entrypoints
+
+P7/P8/P11/P12 use these existing baseline commands plus their directed tests
+and each new committed profile introduced by the approved phase. P9 adds the
+synthesis/netlist/STA and physical evidence listed under the baseline commands
+and verification record. These are required future runs, not P10 results:
+
+```sh
+make sw-format-check sw-policy-check sw-host-test
+ruff check .
+python3 -m pytest -q
+make CONFIG=configs/ci/ihp130-tiny.mk firmware sim
+make CONFIG=configs/ci/ihp130-tiny.mk SIMU=IVERILOG firmware sim
+make CONFIG=configs/ci/ihp130-tiny.mk regress-pr
+make CONFIG=configs/ci/ihp130-tiny.mk regress-nightly
+```
+
+P11 additionally uses `python3 -m pytest -q tests/test_xpi_io.py` as a shared
+PHY check, and P12 uses `python3 -m pytest -q tests/test_dvp.py`; neither is
+sufficient end-to-end evidence. Register new integration cases in the normal
+test/regression flow and record their exact commands. A missing simulator or
+test that returns without executing RTL is unrun coverage, not a pass. For
+shared changes, also run the affected Mini profile/tests without treating
+Mini results as Tiny qualification.
 
 ## Verification requirements for the refreeze
 
@@ -975,8 +1381,9 @@ matrix from historical executed results. It must cover:
 
 - Exact Mini-compatible common addresses, target IRQs, reserved-region errors,
   eight-channel capabilities, handwritten register parity and common HAL use.
-- Unchanged QFN64 perimeter/power counts and safe reset states; one new
-  WS2812 ALT0 route; default interface concurrency and GPIO26 ALT0/ALT1 exclusion.
+- Unchanged QFN64 perimeter/power counts and safe reset states; preserved
+  WS2812 ALT0 plus twelve camera ALT1 routes; audio/camera exclusivity,
+  default interface concurrency and GPIO26 ALT0/ALT1 exclusion.
 - Three-master arbitration, admitted-transaction drain, CDC backpressure,
   reset barriers, simultaneous Crypto input/output and I2S TX/RX DMA, and
   serialized channel-3 clients with bounded failure/recovery.
@@ -988,6 +1395,14 @@ matrix from historical executed results. It must cover:
   keys/results/CDC data or premature physical-erasure acknowledgement.
 - Correct UART/I2C/PWM/WS2812 timing and clock reporting at PCLK24/48/60;
   SDIO 400 kHz initialization and 48/48/40 MHz target cases; independent audio.
+- DVP V2 ABI/IRQ15/request 11/DMA2, truthful staged capabilities, raw PIXCLK
+  and unchanged CDC/FIFO, CAM_XCLK shared-source behavior and RCU target 14.
+- NSS1 PSRAM device initialization, real-size range/burst/CS limits, CPU/DMA
+  mapped writes, whole-frame guards/readback, exact transfer counts and tail
+  drain; no fast-NOR or separate-PSRAM-controller substitution.
+- Snapshot/crop repeated capture, odd-width DMA rejection/PIO fallback,
+  overflow/backpressure, clock loss/reset/recovery, measured transport budgets,
+  optional-memory boot independence and board-level inactive-device isolation.
 
 Directed/formal results do not replace physical clock-tree/reset-tree timing,
 IO electrical, PLL, entropy, power or package evidence. Keep these gates tied
@@ -1040,9 +1455,10 @@ of a 96/240 MHz Gen1 operating point.
 Current-revision verification and physical reports govern readiness. Reusable
 VIP, coverage closure, full CDC/RDC, DFT/MBIST, PVT/MMMC, post-layout timing,
 power characterization, regulatory and silicon qualification remain separate.
-Gen1 additionally requires P7/P8 implementation, shared PWM reporting and I2S
+Gen1 additionally requires P7/P8/P11/P12 implementation, shared PWM reporting and I2S
 extension closure, oscillator/PLL and 96 MHz XIN characterization, package/
-bonding and power-integrity review, pad-level I2S/SDIO/WS2812 validation and
+bonding and power-integrity review, pad-level I2S/SDIO/WS2812/DVP validation,
+actual sensor and XPI PSRAM device/timing qualification, and
 96/240 MHz processor, MEM120 and PCLK60 timing evidence before these targets
 may be advertised as supported operating conditions. The current IHP130 PLL
 binding and PLL OpenSTA profile remain qualification prerequisites. Do not
@@ -1050,13 +1466,14 @@ claim new measurements or change policy based on the product target alone.
 
 ## Implementation handoff
 
-The first implementation step is the P7 preflight below. P6 freezes the
-specification; it does not start implementation or mark P7-P9 complete.
+The first implementation step after this P10 freeze is the P7 preflight below.
+The remaining sequence is P7 -> P8 -> P11 -> P12 -> P9. P10 does not start
+implementation, rename any P0-P9 phase or close historical physical gaps.
 
 ```text
 Use $retrosoc-feature-implementation in preflight mode for feature tiny-soc.
 Target SoCs: TINY.
 Phase: TINY-P7 - Shared IP and Eight-Channel DMA Integration.
 Specification: docs/ip/tiny-soc.md; evidence: docs/ip/tiny-soc-verification.md.
-Start from configs/ci/ihp130-tiny.mk, PDK IHP130, at the existing 24 MHz safe-clock baseline. Map the frozen shared-IP addresses/ABI/HAL, eight DMA channels, three AXI32 masters, Crypto private banks and GPIO26 ALT0 to repository sources. Preserve QFN64, 32 GPIO, user SRAM and shared-IP ownership; identify the documented I2S/remap prerequisites and do not claim unsupported modes. Keep Tiny RCU/dual-clock implementation in P8, validate affected Mini consumers, and retain the existing warning/metric policy. Do not assume a 96 MHz or qualified PLL profile already exists. Produce the single-phase preflight and validation mapping before RTL/HAL implementation.
+Start from configs/ci/ihp130-tiny.mk, PDK IHP130, at the existing 24 MHz safe-clock baseline. Map the frozen shared-IP addresses/ABI/HAL, eight DMA channels, three AXI32 masters, Crypto private banks and GPIO26 ALT0 to repository sources. Preserve QFN64, 32 GPIO, 128 KiB user SRAM, all P6-assigned Gen1 alternate routes and shared-IP ownership. Reserve channel 2/request 11 for the unchanged DVP V2 at 0x1000E000/IRQ15, but keep its capability unsupported until P12. Do not implement P11/P12 as part of P7: camera ALT1 GPIO12-23, shared CAM_XCLK, RCU target 14 and optional XPI NSS1 PSRAM at 0x54000000/GPIO29 are frozen later-phase constraints, not current support. Preserve NOR boot, SRAM-only operation, exact-frame/tail-drain requirements, camera/I2S exclusion and the P10 -> P7 -> P8 -> P11 -> P12 -> P9 dependency order. Identify the shared PWM dynamic-clock and I2S/remap prerequisites; keep Tiny RCU/dual-clock work in P8 and do not claim unsupported modes. Validate affected Mini consumers and retain warning/metric policy. Do not assume a 96 MHz or qualified PLL profile already exists. Produce the single-phase preflight, file ownership map, public-interface changes and profile-specific validation mapping before RTL/HAL implementation.
 ```

docs/ip/xpi.md

@@ -18,6 +18,15 @@ definitions remain the executable sources of truth:
 
 XPI V2 intentionally breaks the retired `qspi.h` register and HAL ABI.
 
+The [Tiny Gen1 target](tiny-soc.md) retains this shared XPI register/LUT/PHY
+contract and selects optional NSS1 PSRAM at `0x54000000` with GPIO29 ALT0.
+NSS0 remains the boot NOR path; SRAM-only operation is preserved. Tiny P11
+must validate initialization, actual capacity, mapped CPU/DMA writes, serial
+boundaries/CS timing and transport bandwidth before P12 DVP capture uses the
+RAM. Frames use DVP request 11 and ordinary DMA AXI destination writes, not
+the XPI indirect TX path. No extra PSRAM controller/window, XPI ABI change or
+qualified camera/PSRAM rate is implied by the documentation freeze.
+
 ## Commercial Reference Survey
 
 The survey was refreshed on 2026-08-20 from vendor documentation. "Active"

docs/soc-family-positioning.md

@@ -55,8 +55,10 @@ Tiny-Connect, BLE, IEEE 802.15.4 and Wi-Fi are deferred product research.
 The committed baseline still uses 24 MHz, no PLL, two UARTs, two I2C
 controllers and legacy pad routing. The QFN64 Gen1 product/package target
 was established on 2026-09-26 and extended on 2026-09-30 with shared IP,
-eight-channel DMA and explicit no-PLL/PLL clock and reset trees. P7-P9 must
-implement and qualify that target. Existing generated datasheets describe
+eight-channel DMA and explicit no-PLL/PLL clock and reset trees. The
+2026-10-01 P10 refreeze adds DVP V2 camera routing and optional XPI PSRAM
+frame buffers. The remaining order is P10 -> P7 -> P8 -> P11 -> P12 -> P9;
+old phase IDs/titles are preserved. Existing generated datasheets describe
 the baseline, not completed implementation of the refreeze.
 
 ### Gen1 Product and Package Target
@@ -66,11 +68,11 @@ the baseline, not completed implementation of the refreeze.
 | CPU | One Hazard3 RV32IMC hart; A extension disabled until atomic bus semantics are qualified |
 | On-chip memory | 128 KiB user SRAM plus six private Crypto banks (24 KiB); larger user SRAM and retention deferred |
 | Code storage | XPI NOR boot, loaded into SRAM; authenticated recovery boot deferred |
-| Memory model | No MMU, HP hart, or external DRAM/PSRAM dependency |
+| Memory model | No MMU, HP hart or external RAM boot dependency; optional initialized XPI NSS1 PSRAM for whole-frame data, bounded by actual device capacity |
 | Interconnect | AXI32 with CPU, central DMA and SDIO private-DMA masters; APB4 control and explicit domain bridges; no RIB/RIBP |
 | Software | Shared peripheral specifications, addresses and HAL source; product-specific RCU/SYSCTRL backend and routing/clock configuration; RV32IM compiler target |
 | Clock/reset | Safe REF24 boot; external-XIN no-PLL up to 96 MHz or a 24 MHz reference/single-output PLL up to 240 MHz; MEM up to 120 MHz, PCLK up to 60 MHz, fixed 1 MHz CLINT tick; no independent safety RC |
-| Edge I/O | 32 user GPIO, one UART, one I2C, one full-duplex master/slave I2S target, one 3.3 V 1-bit/4-bit SDIO host, two timers, eight central DMA channels, four PWM outputs, RTC, watchdog and XPI |
+| Edge I/O | 32 user GPIO, one UART, one I2C, one full-duplex master/slave I2S target, alternate 8-bit DVP V2 camera profile, one 3.3 V 1-bit/4-bit SDIO host, two timers, eight central DMA channels, four PWM outputs, RTC, watchdog and XPI |
 | Shared services | RNG V2, CRC V2, WS2812 and Crypto V2 at Mini-compatible addresses; entropy and security claims require separate qualification |
 | Package | QFN64 plus separate EP: 48 signal and 16 power/ground terminals; preferred 9 x 9 mm, 0.5 mm pitch pending physical review |
 | Dedicated signals | Six boot XPI pins and five JTAG pins outside the 32 GPIO; XPI CS1-3 use GPIO29-31 |
@@ -79,9 +81,16 @@ the baseline, not completed implementation of the refreeze.
 The normative [Tiny Gen1 contract](ip/tiny-soc.md) defines the complete QFN64
 pinout, power/reset requirements and GPIO/ALT0/ALT1 table. Default SDIO,
 full-duplex I2S with MCLK, UART0 and I2C0 use 15 non-overlapping GPIO, leaving
-17; adding WS2812 on GPIO26 ALT0 leaves 16. Independent boot Flash and JTAG
-remain available. The shared-IP addresses, DMA/IRQ allocations, Tiny RCU bank
-and clock/reset behavior are frozen targets, with implementation in P7/P8 and
+17; adding WS2812 on GPIO26 ALT0 leaves 16. The alternate camera profile uses
+GPIO12-23 ALT1 and excludes I2S/default PWM there. Camera, SDIO, UART0, I2C0,
+WS2812 and PSRAM NSS1 plus optional card/camera controls use 28 GPIO, leaving
+GPIO27/28/30/31. CAM_XCLK and GPIO28 CLKOUT share one RCU generator.
+Independent boot Flash and JTAG remain available. DVP retains the shared V2
+ABI at `0x1000E000`/IRQ15 and uses DMA2/request 11; frames may exceed internal
+SRAM through NSS1 at `0x54000000` without adding a master or controller.
+The shared-IP addresses, DMA/IRQ allocations, Tiny RCU bank
+and clock/reset behavior are frozen targets, with implementation in P7/P8,
+PSRAM transport in P11, DVP capture in P12 and
 physical acceptance in P9. SDIO reaches target clocks of 48 MHz at SYS96/192
 and 40 MHz at SYS240 using the existing integer divider. XIN loss stops the
 reference/watchdog domain too; recovery requires the external source and
@@ -93,8 +102,9 @@ USB, standalone general SPI, CAN and ADC remain future product work. Controlled
 CPU/peripheral clock gating is part of the new RCU target. Shared PWM dynamic
 clock reporting and I2S slave support require common-IP work; missing macros,
 Pad timing and physical evidence remain explicit gates. Neither the initial
-functional profile nor this specification establishes a measured frequency
-ceiling, power-current, wake-latency or security claim.
+functional profile nor this specification establishes a measured camera FPS,
+qualified sensor/PSRAM part, frequency ceiling, power-current, wake-latency
+or security claim.
 
 ### Commercial Reference Points
 
@@ -431,7 +441,7 @@ software quality.
 
 | Tier | Claim gate |
 | --- | --- |
-| Tiny | Gen1 target: unchanged QFN64, shared IP/eight-channel DMA, product RCU/CDC/reset, no-PLL 96 MHz and PLL 240 MHz evidence; low-power, entropy and security claims require separate qualification |
+| Tiny | Gen1 target: unchanged QFN64, shared IP/eight-channel DMA, product RCU/CDC/reset, no-PLL 96 MHz and PLL 240 MHz evidence, DVP snapshot/crop to optional XPI PSRAM with measured transport and Pad timing; low-power, entropy and security claims require separate qualification |
 | Mini | Repeatable Linux boot, at least 64 MiB usable main memory, native memory bursts, and management-controlled start/stop recovery |
 | Std | Full AXI4 ordering tests, coherent accelerator traffic, 1080p60 graphical desktop, audio playback, and NPU inference under concurrent DMA load |
 | Pro | Four-hart coherent SMP stress, RV64 distribution boot, more-than-4-GiB memory validation, and concurrent GPU/NPU/video operation |

requirements/build.txt

@@ -10,5 +10,5 @@ packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73
 typing-extensions==4.16.0 --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8
 typing-inspect==0.9.0 --hash=sha256:9ee6fc59062311ef8547596ab6b955e1b8aa46242d854bfc78f4f6b0eff35f9f
 click==8.1.8 --hash=sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2
-pillow==9.0.1 --hash=sha256:855c583f268edde09474b081e3ddcd5cf3b20c12f26e0d434e1386cc5d318e7a
+pillow==12.3.0 --hash=sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756 --hash=sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a --hash=sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59 --hash=sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45 --hash=sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3 --hash=sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df --hash=sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139 --hash=sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b --hash=sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39 --hash=sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e --hash=sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8 --hash=sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1 --hash=sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8 --hash=sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89 --hash=sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5 --hash=sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130 --hash=sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd --hash=sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b --hash=sha256:25b9b82bb22e6e2b3cd07b39c68b7b862001226cb3dff7130d1cb914121b39ed --hash=sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace --hash=sha256:300557495eb45ebb8aec96c2da9c4be642fbf7cd937278b4013ba894ea8eb0eb --hash=sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931 --hash=sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510 --hash=sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6 --hash=sha256:37dc8f7bbb66efe481bb60defacef820c950c24713fb44962ed6aa2a50966de1 --hash=sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce --hash=sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385 --hash=sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e --hash=sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c --hash=sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7 --hash=sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace --hash=sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c --hash=sha256:514435a37670e3e5e08f3945b68718b6ed329bb84367777e16f9f4dfe1e61a0f --hash=sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64 --hash=sha256:5594fc43d548a7ed94949d139aa1341b270f1863f11cfd37f5a6c8b778a6b67f --hash=sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a --hash=sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827 --hash=sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17 --hash=sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4 --hash=sha256:6c0016e7b354317c4e9e525b937ac8596c38d2d232b419529b9cd7a1cd46e39a --hash=sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701 --hash=sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e --hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91 --hash=sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66 --hash=sha256:85f998ea1848bc6757289e739cfbdda3a04adfd58b02fc018ce54d754a5ce468 --hash=sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217 --hash=sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658 --hash=sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418 --hash=sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a --hash=sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c --hash=sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330 --hash=sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402 --hash=sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09 --hash=sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930 --hash=sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f --hash=sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec --hash=sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a --hash=sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94 --hash=sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468 --hash=sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b --hash=sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965 --hash=sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8 --hash=Line truncated
 pyslang==11.0.0 --hash=sha256:3346f50648c0d62ac63856908f86c850d9f8c3d2b07d7a4f36d315f5afa2b5d4

requirements/ci.txt

@@ -15,7 +15,7 @@ pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698
 pytest==8.3.5 --hash=sha256:c69214aa47deac29fad6c2a4f590b9c4a9fdb16a403176fe154b79c0b4d4d820
 PyYAML==6.0.3 --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b
 rich==15.0.0 --hash=sha256:33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb
-ruff==0.11.0 --hash=sha256:92c0c1ff014351c0b0cdfdb1e35fa83b780f1e065667167bb9502d47ca41e6db
+ruff==0.16.9 --hash=sha256:0e1dbc2073624dee6618d41d0098690a7244654af746704b64759e12b6b6b385 --hash=sha256:12b625c6cfba78d285d9f48eda5f053374f1e53cb10ef17342a383750db99161 --hash=sha256:1632eb1d6197f33bd00b1acbc5b71009e89a8895c158e2d2b03a834fac964ab6 --hash=sha256:41e3870277694177429b56406d65dfbdb2c2802c52b715edaf6a0b829c69d4ee --hash=sha256:447fc07e1573afff7cb02803462b12b6c8ece7cf10e2cd78565fa6d7a1c0bf8d --hash=sha256:4684dded7db60aa57cb118fa158630f5feade4af5782903b6053484bdf9bd129 --hash=sha256:6bd40fec8cd4c8a3d4dd589bd8ad4e6320c13c29234159bfd959a40d529d597b --hash=sha256:7baa24ef5fc8e77aa93879e1d3f43754a01ae488e869f1ae30cf431afd4d2452 --hash=sha256:8a3e039a6a40ed976c491722b60e0ae4a4aa1a86057f540ee7a37a5d19ae9120 --hash=sha256:8adbe4e58af167f767d7b2ba5e83c42e878350796cf78c2f5e14ab9903a92588 --hash=sha256:95e6f022090368ab3b824c36276839c53b2adf1a3f4c09fefc33dfc400f6da96 --hash=sha256:a21713e629d3e5bdb2f5c2def1cc7f04f47fa8e1a7eb0571b4a28e1da64bc728 --hash=sha256:a41aac6230aadfaa133bdfa1614488531ffa3e0837567ae04c0da2058a9c0f9e --hash=sha256:a5f27be168556594a86d2f415db0cf43f5291917849318f873c7e2791f7a8c67 --hash=sha256:b3f951b14d865d5952c89d40a5ca07e87abe24fa5453299878411e127748fb1c --hash=sha256:c2529fb5896d49115b0e9aa8f887490b34bbe76baf879ec2264ac59406869ce7 --hash=sha256:d29c934357e45642fda2f34c0b1f4025b4a6c01e15e4bf0016879d60078a142c --hash=sha256:ed1a252039200f57a59eebc063b54beabea67bfbaaca0eeaa7f54b5fbcda2284
 shellingham==1.5.4 --hash=sha256:7ecfff8f2fd72616f7481040475a65b2bf8af90a56c89140852d1120324e8686
 tomli==2.4.1 --hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe
 typer==0.27.0 --hash=sha256:6f4b27631e47f077871b7dc30e933ec0131c1390fbe0e387ea5574b5bac9ccf1

requirements/rtthread.txt

@@ -1,4 +1,4 @@
 # Official RT-Thread build frontend, isolated from the SDK Python environment.
 --only-binary=:all:
 --require-hashes
-scons==4.8.1 --hash=sha256:a4c3b434330e2d7d975002fd6783284ba348bf394db94c8f83fdc5bf69cdb8d7
+scons==4.11.1 --hash=sha256:4210d1a80a62e986029208117991b6347ccaaaab37b67463a3ff31ee065dc487 --hash=sha256:454cef364348053422696e3d2ecb4fa593c96a624f955842eaaea64f95c8d11d

rtl/tiny/README.md

@@ -23,10 +23,21 @@ The 2026-09-30 P6 target adds shared RNG/CRC/WS2812/Crypto, eight-channel DMA
 and a Tiny-owned RCU/SYSCTRL, with no-PLL 96 MHz and single-output-PLL
 240 MHz limits. It preserves QFN64 and adds WS2812 on GPIO26 ALT0. The
 committed RTL/profile still describes the initial 24 MHz/no-PLL implementation;
-P7-P9 must implement and qualify the new addresses, streams, clock domains,
+P7/P8 must implement the new addresses, streams, clock domains,
 reset barriers and shared-driver compatibility. No PLL macro/timing support
 is implied by the new specification or the `HAVE_PLL` selector alone.
 
+The 2026-10-01 P10 documentation refreeze adds the existing DVP V2 contract,
+camera GPIO12-23 ALT1 (mutually exclusive with I2S), DMA2/request 11 and
+optional XPI NSS1 PSRAM at `0x54000000` through GPIO29. Whole-frame external
+storage does not change the 128 KiB SRAM, NOR boot, QFN64/power budget or
+three-master/eight-channel target. CAM_XCLK shares RCU CLKOUT; RCU target 14
+and DVP endpoint capabilities remain unsupported until actual integration.
+The remaining order is P10 -> P7 -> P8 -> P11 (PSRAM transport) -> P12
+(camera capture) -> P9 (system/physical qualification). P11/P12 require real
+pin-level XPI PSRAM and full-frame readback, not fast-flash or the separate
+PSRAM controller's tests. No camera/PSRAM rate is qualified by this freeze.
+
 `make CONFIG=configs/ci/ihp130-tiny.mk regress-pr` runs only Tiny's IHP130
 matrix. The regression runner also accepts `--soc TINY`; leaving it unset
 retains the combined Mini/Tiny IHP130 matrix. `netsim-boot` uses the compact