docs(tiny): record R2-P8 PSRAM validation

Document the optional NSS1 PSRAM contract, workload and evidence policy, P7 acceptance boundary, P8 correction follow-up, and profile-specific synthesis, netlist and observational STA results. Keep full Icarus, physical qualification and human P8 acceptance explicitly open.

configs/README.md

@@ -82,6 +82,10 @@ external input to REF24 at boot and permit no-PLL XIN transitions. See the
 [P7 runbook](../docs/ip/tiny-soc-r2-clock-reset.md) for the evidence boundary.
 `TINY_P7_ACCEPTANCE=YES APP=ci_smoke` selects the distinct RCU acceptance image
 and configuration digest; ordinary Tiny acceptance firmware remains the default.
+`TINY_P8_ACCEPTANCE=YES APP=ci_smoke` instead selects the optional XPI PSRAM
+transport image and its distinct digest. Populate the verification device with
+`TINY_SIM_ARGS=+tiny_p8_psram`; P7/P8 acceptance selectors are mutually exclusive.
+See the [P8 runbook](../docs/ip/tiny-soc-r2-psram.md) for bounded DMA and evidence.
 `make SOC=TINY` selects this
 committed profile, and `make SOC=TINY PDK=IHP130` selects explicit compatibility.
 Do not substitute Mini's `ci/ics55.mk` for Tiny. Acceptance evidence belongs in

crt/README.md

@@ -168,6 +168,12 @@ polling, interrupts, errors, performance counters, and configuration locks.
 Reset-time NSS0 boot behavior and JTAG NOR programming are defined in the
 [XPI V2 controller contract](../docs/ip/xpi.md).
 
+`<retrosoc/hal/xpi_psram.h>` adds an explicit optional ESP-PSRAM64H NSS1
+reference profile, identity/geometry checks and bounded mapped-DMA validation.
+It reserves LUT8..11, preserves NOR configuration, and never initializes RAM
+as a boot dependency. The caller owns pins, XPI quiescence, SRAM residency and
+DMA leases. See the [Tiny P8 runbook](../docs/ip/tiny-soc-r2-psram.md).
+
 `crt/inc/` is legacy or generated compatibility material. It is not an active
 public include root for the firmware build; new code must not add dependencies
 on it.

docs/ip/tiny-soc-r2-clock-reset.md

@@ -3,7 +3,10 @@
 This phase starts at `43a3c8d453b6d41df3536719ebc6d1f4521bc7cd`, against frozen
 specification blob `7e19de49d49efaafacccfa85671e314d53dd15a4`. Implementation
 is authorized; phase acceptance still requires review of the completed gates.
-No P8 implementation, commit, push, or physical frequency qualification follows.
+At this historical P7 checkpoint no P8 implementation, commit, push, or
+physical frequency qualification followed. P7 was later human-accepted on
+2026-10-15; the separate P8 handoff and evidence ledger now govern subsequent
+work.
 
 ## Product and ownership
 

docs/ip/tiny-soc-r2-psram.md

@@ -0,0 +1,113 @@
+# Tiny R2-P8 XPI PSRAM transport
+
+This phase implements optional NSS1 framebuffer storage through shared XPI V2.
+It does not add a PSRAM controller, external boot dependency, DVP integration
+or physical rate qualification. P7 was explicitly accepted by the maintainer
+on 2026-10-15 at `655c587`; its retained physical and final-Icarus gaps remain.
+
+## Implementation and ownership
+
+`crt/include/retrosoc/hal/xpi_psram.h` and the corresponding shared HAL sources
+own the ESP-PSRAM64H reference profile. The caller owns XPI exclusively, runs
+code and interrupt paths from SRAM, selects GPIO29 ALT0 and provides external
+inactive-high NSS1 bias. No startup path initializes or allocates external RAM.
+The helper reserves slot 1 and LUT sequences 8..11 without changing NSS0 or
+LUT 0. SPI reset/identification checks manufacturer `0d`, KGD `5d` and density
+`26`, then enters QPI. Three ID bytes are sufficient to identify the selected
+geometry; extended ID bytes are not advertised as read. Reinitialization exits
+QPI first, including when the device survived a controller/system reset.
+
+Mapped access is enabled only after identification succeeds. The actual
+capacity is 8 MiB (`0x54000000..0x547fffff`); the 64 MiB slot aperture is not
+usable capacity. Missing/unrecognized devices return `RS_ENOTSUP`, with mapped
+NSS1 disabled and NOR access restored when bounded cleanup succeeds. A cleanup
+timeout remains a failure requiring coordinated recovery. A clock change or
+reset invalidates the software session: quiesce all users and initialize again
+before exposing buffers. No helper owns a DMA channel implicitly.
+
+MEM24/48/96/120 use SCK=MEM/2, six quad-read dummy clocks, at least 3 ns setup,
+20 ns hold and 50 ns inactive CS. The core timeout leaves two MEM cycles below
+the model's 8 us active-CS limit. Direct DMA uses SOFTWARE requests, aligned
+32-bit words and at most four-beat bursts. Align a four-beat job to 16 bytes;
+the unchanged DMA splits at 4 KiB and these bursts cannot cross the configured
+1 KiB serial boundary. This deliberately bounded starting profile is not a
+maximum-throughput or physical-device claim.
+
+Shared `xpi_mm` fixes preserve the register ABI: correct byte-lane masks and
+narrow-burst collection addresses, reject configured serial-boundary crossings,
+retire writes when the serial core terminates before all payload, preserve
+presented read responses across timeout, reject short sequences, and wait for
+physical-command completion before exposing the command's final read beat.
+Failures were reproduced before these changes; their logs remain retained.
+
+The reference device model moved from Mini verification into
+`rtl/model/ESP_PSRAM64H.sv`, retaining model behavior and parameters. Mini
+filelists and its separate-controller tests consume the same shared model;
+their results remain compatibility evidence, not Tiny XPI acceptance.
+
+## Workloads and verdicts
+
+`TINY_P8_ACCEPTANCE=YES APP=ci_smoke` selects the SRAM-resident P8 image and a
+distinct configuration digest. It is mutually exclusive with P7 acceptance.
+The model is populated only with `+tiny_p8_psram`; `+p8_absent` disconnects it.
+The ordinary baseline does not depend on its presence.
+
+Each supported functional clock profile initializes through actual XPI pins,
+checks CPU byte/halfword/word access and first/last physical addresses, then
+writes 1024 deterministic bytes from SRAM through leased DMA3 into
+`0x54000c00`. The range ends exactly at a 1 KiB serial and 4 KiB page
+boundary; crossing cases are rejected by the HAL and focused tests. CPU and DMA independently read back every word; adjacent
+canaries must remain unchanged. A second round overlaps independent CPU SRAM
+work and records its progress. Firmware returns to SAFE24 and checks NOR
+readback. This finite transport workload is not a camera frame or P9 capture
+qualification.
+
+Firmware records elapsed SYS cycles from DMA start through observed completion,
+payload bytes and CPU progress. `tiny_p8_observers.svh` independently records
+MEM-clock window length, mapped byte counts, and maximum consecutive
+VALID-without-READY cycles for all five AXI channels. These are verification
+observations, not new hardware registers. Payload rate is bytes times clock
+rate divided by elapsed cycles; stall time is observed MEM cycles divided by
+MEM rate. Software/setup/polling costs and observation-window boundaries must
+remain visible when interpreting the numbers. They are not unrestricted
+worst-case bounds or proof of a safe camera input rate.
+
+Both simulators must succeed with SYSCTRL TEST_STATUS / `SIM_TEST_PASS` and
+without forbidden markers. `scripts/tiny_r2_p8.py` rejects missing profile or
+measurement rows, partial byte counts and zero CPU progress. Optional absence
+has a separate verdict and cannot qualify populated-device transport. The
+report captures source/runtime inputs, locked tools, firmware and simulator
+binaries; historical or changed-input runs cannot be promoted as fresh results.
+
+## Execution
+
+Activate the locked local environment when available. Start with focused tests
+and SDK/style/policy checks, then the explicitly selected committed profile:
+
+```sh
+python3 -m pytest -q tests/test_tiny_r2_p8.py tests/test_tiny_r2_p8_evidence.py
+make sw-format-check sw-policy-check sw-host-test
+make rtl-format-check rtl-style-check-all rtl-readiness-check-all
+python3 scripts/regress.py --root . --suite pr --soc TINY --pdk ICS55 --dry-run
+python3 scripts/regress.py --root . --suite pr --soc TINY --pdk IHP130 --dry-run
+make CONFIG=configs/ci/ics55-tiny.mk SOC=TINY PDK=ICS55 APP=ci_smoke \
+  TINY_P8_ACCEPTANCE=YES BUILD_TIMESTAMP=2026-10-15-05-00 firmware comp
+```
+
+Build Icarus with the same profile, timestamp and software settings using
+`SIMU=IVERILOG comp`, and reuse the retained HEX. Before each final replay,
+capture inputs with `scripts/tiny_r2_p8.py capture --variant-root <variant>
+--simulator <simulator> --output <attempt>/source.json`. Run the selected
+binary through `scripts/run_flow.py` with `<attempt>/sim.log` and
+`<attempt>/result-sim.json`, explicit firmware path, `+tiny_p8_psram` and the
+recorded cycle/time budget. Report with `scripts/tiny_r2_p8.py report` using
+the same source, variant, simulator and attempt. Use a separate attempt and
+`--absent` for the absent-device case; never overwrite prior evidence.
+
+Repeat affected checks for explicit IHP130 compatibility and the committed
+XIN48/XIN96 profiles. Default ICS55 covers SAFE24/PLL192/PLL240 functional
+profiles in one image. Synthesis, macro binding, netlist function and
+observational STA remain required; full long-running Icarus peripheral
+firmware and physical/board qualification remain in the final campaign.
+Consult the verification ledger for actual passed/failed/unrun gates; these
+commands are not themselves evidence of completion.

docs/ip/tiny-soc-verification.md

@@ -1,5 +1,73 @@
 # Tiny MCU Verification Record
 
+## TINY-R2-P7 human acceptance and P8 implementation authorization (2026-10-15)
+
+The maintainer explicitly confirmed P7 human acceptance and authorized the
+previously approved TINY-R2-P8 implementation plan in the development session.
+The accepted checkpoint is `655c5871ea1789afea1c037c1b566a7be02b2bc6`.
+All seven CI workflows for that commit completed successfully, including
+ICS55 run `38619690260`, IHP130 run `38619690366` and quality run `38619690155`.
+This acceptance retains the source-reset and response-conservation boundaries
+recorded below. Full long-running Icarus firmware remains deferred to final
+Tiny qualification; negative observational STA and physical/board/rate gaps
+are not waived or reclassified. Historical pending-human-review statements
+below describe their original checkpoints. P8 implementation is authorized;
+P8 acceptance and later phases are not implied.
+
+## TINY-R2-P8 implementation checkpoint (2026-10-15)
+
+The approved P8 implementation adds optional XPI NSS1/GPIO29 PSRAM and keeps
+NOR/SRAM-only boot independent. The shared `ESP_PSRAM64H.sv` model is now
+owned at `rtl/model` and remains compatible with Mini's separate-controller
+tests. Shared XPI fixes cover byte-lane strobes, narrow-burst address
+progression, serial-boundary rejection, early core termination, held read
+responses, short sequences and final-command completion. The manual HAL
+validates ESP-PSRAM64H identity `0d/5d/26`, 8 MiB geometry, bounded MEM24/48/96/120
+timing and aligned four-beat DMA jobs.
+
+The focused P8 campaign passed **28 tests** across both simulators, including
+identity, mapped CPU/DMA paths, first/last addresses, byte/halfword/word lanes,
+canaries, 4 KiB/serial boundaries, timeout/held-response/late-error cases and
+forbidden-device behavior. The ICS55 full Verilator firmware passed with
+`P8_RESULT code=0 profiles=3` and `SIM_TEST_PASS Tiny`; retained records are
+under `build/ics55-tiny-2026-10-15-05-00-28a7d10f3a7b/meta/tiny-r2-p8/`.
+Observed windows report 1024-byte CPU/DMA transfers with four-beat bursts at
+SAFE24, PLL192 and PLL240. These are finite digital workload measurements,
+not worst-case bounds, camera budgets, physical rates or board qualification.
+The optional absent-device path is a separate bounded rejection case and does
+not advertise PSRAM capability.
+
+The handoff-required full long-running Icarus Tiny firmware was started once
+but intentionally interrupted before a terminal verdict because that gate is
+deferred to final Tiny qualification. Icarus P8 pin-level focused coverage
+passed; the interrupted full-firmware record remains `NOT_RUN/PARTIAL` and is
+not relabeled. P8 now has explicit IHP130 compatibility replay, source
+snapshot/report generation, synthesis/netlist-function checks and
+observational STA for both profiles. Human phase acceptance remains open.
+P9 DVP, SPI, PIO-lite, PPALite and physical qualification remain unimplemented.
+
+## TINY-R2-P8 P1 correction follow-up (2026-10-15)
+
+The review identified two evidence-blocking issues and both were corrected.
+`rs_xpi_psram_validate_dma()` now checks every emitted burst against the
+configured 1 KiB serial boundary, the 4 KiB DMA page boundary, capacity and
+alignment before a session starts. The P8 workload begins at
+`0x54000c00`, an aligned legal boundary; aligned crossing and malformed cases
+remain rejected by host tests and the XPI directed tests. The MEM observer now
+maps AW/W/AR/B/R stall counters to the correct output fields and records the
+maximum observed CS duration.
+
+After the correction, the P8 focused suite and C/RTL checks passed again. A
+fresh ICS55 Verilator replay passed SAFE24/PLL192/PLL240 with
+`P8_RESULT code=0 profiles=3` and `SIM_TEST_PASS Tiny`; a fresh IHP130 SAFE24
+replay passed with `P8_RESULT code=0 profiles=1` and `SIM_TEST_PASS Tiny`.
+Evidence is retained below the corresponding `build/*-08-00-*/meta/tiny-r2-p8`
+directories. These are behavioral/model results only. Full long Icarus remains
+deferred to final Tiny qualification. Both profiles also have current
+synthesis, netlist boot and observational STA records; source-bound promoted
+reports are retained under each profile's promoted evidence directory. Human
+P8 acceptance remains open.
+
 ## TINY-R2-P7 source-reset integration contract (2026-10-14)
 
 The follow-up review identified a missing source-side reset proof, not a
@@ -924,8 +992,8 @@ not a prerequisite to the architectural improvements in R2-P3 through R2-P5.
 | TINY-R2-P4 - Dual-Port Hazard3 and Four-Bank Local SRAM | Actual separate I/D paths, four independent 32 KiB bank frontends, SYS-clocked physical main-SRAM macros, local latency/fairness, FENCE.I, debug/reset and early inventory/SDC/macro-binding updates. | Implementation and planned functional validation complete on `4db2752` plus retained worktree snapshot; matched-image DMA throughput regression and human phase acceptance pending review; timing remains observational |
 | TINY-R2-P5 - Per-Target Concurrent Fabric | Cross-target concurrency, one combined transaction per target, central-DMA read/write overlap, AW/W binding, errors, simultaneous faults/counters and accepted-transfer drain. | Pending |
 | TINY-R2-P6 - Shared IP and Eight-Channel DMA Integration | Legacy P7 obligations; shared PWM reporting, I2S slave and alternate-input-route prerequisites; common ABI/HAL parity; Crypto banks/lifecycle; truthful capabilities and affected Mini compatibility. | Pending |
-| TINY-R2-P7 - Tiny RCU and Dual-Mode Clock/Reset Integration | Legacy P8 obligations with main SRAM in SYS and XPI in MEM; atomic rate changes, all actual CDC/reset barriers, clock failures, WFI leaf gating and reserved DVP controls. | Pending |
-| TINY-R2-P8 - XPI PSRAM Framebuffer Bring-up | Legacy P11 obligations: real pin-level NSS1 device transport, CPU/DMA mapped-write readback, boundaries/recovery, payload rate and worst backpressure. | Pending |
+| TINY-R2-P7 - Tiny RCU and Dual-Mode Clock/Reset Integration | Legacy P8 obligations with main SRAM in SYS and XPI in MEM; atomic rate changes, all actual CDC/reset barriers, clock failures, WFI leaf gating and reserved DVP controls. | Human accepted 2026-10-15 at `655c587`; full long Icarus firmware and physical/timing gaps remain explicitly deferred |
+| TINY-R2-P8 - XPI PSRAM Framebuffer Bring-up | Legacy P11 obligations: real pin-level NSS1 device transport, CPU/DMA mapped-write readback, boundaries/recovery, payload rate and worst backpressure. | ICS55/IHP130 Verilator, focused dual-simulator, synthesis, netlist boot, STA and promoted reports complete; full long Icarus deferred and human P8 acceptance pending |
 | TINY-R2-P9 - DVP Camera Profile and Frame Capture Integration | Legacy P12 obligations: unchanged DVP ABI/FIFO, DMA2/request 11, exact frame length, final-tail drain, snapshots/crops, missing-clock recovery and camera/audio exclusion. | Pending |
 | TINY-R2-P10 - System Performance and Regression Qualification | Complete current-profile functional regression and workload/contention A/B, measured real-time budgets, synthesis/macro mapping, netlist checks and explicit missing coverage. | Pending |
 | TINY-R2-P11 - IHP130 Physical and Product Qualification | Final joint CPU/main-SRAM timing, CTS/reset distribution, extracted PVT/IO/package/power evidence, qualified clock/PLL inputs and device operating points; close remaining legacy P9 obligations. | Pending |

docs/ip/tiny-soc.md

@@ -1169,7 +1169,7 @@ Use [XPI V2](xpi.md) NSS1 with GPIO29 ALT0 (QFN pin 14), sharing the dedicated
 SCK/D0-3 wires with boot NOR on NSS0. The NSS1 aperture is
 `0x54000000..0x57FFFFFF` (64 MiB), not a promise of fitted RAM capacity. The
 reference verification geometry is the existing 8 MiB ESP-PSRAM64H model,
-currently `rtl/mini/dv/model/ESP_PSRAM64H.sv`: its valid mapped data range is
+currently `rtl/model/ESP_PSRAM64H.sv`: its valid mapped data range is
 `0x54000000..0x547FFFFF`. R2-P8 must place any reused device model under shared
 or Tiny-owned verification ownership without importing Mini product RTL or
 copying the separate `apb4_psram` controller. Model reuse alone does not

rtl/model/README.md

@@ -5,11 +5,18 @@ The models are excluded from the self-owned synthesizable RTL style profile and
 retain their upstream notices and behavior. The repository import normalizes
 line endings and trailing whitespace.
 
+`ESP_PSRAM64H.sv` is the project-owned SDR SPI/QPI 8 MiB reference model,
+shared by Mini's separate PSRAM controller and Tiny's XPI NSS1 verification.
+It was relocated from `rtl/mini/dv/model` for TINY-R2-P8; controller/product
+acceptance evidence is not interchangeable. Keep its existing fault-injection
+and timing parameters compatible with Mini.
+
 | File | Upstream source | Revision | Upstream SHA-256 |
 | --- | --- | --- | --- |
 | `at24cxxx.sv` | `https://github.com/retroSoC/i2c.git` | `73b024547c5cd70fb8bf801cc7757db2536c604f` | `636ed7e58574735a80943122178da8e1b23a48d443ec11d96ccdbd8618da404b` |
 | `mic.sv` | `https://github.com/retroSoC/i2s.git` | `bd0978e8b45e4cf4c1335a1fa7311385d2a4e805` | `2d5264092bac13f28c5e38cfba4a9288afb6d704c7821f40265177c32715a6b3` |
 | `w25q128jvxim.sv` | `https://github.com/retroSoC/spi.git` | `515cb408806584525605b4747db5e890dbdf1928` | `4b95f007a39854dc2690cf0b608b1b4b56a61adbf1e7c736e7ab5d44d46a112f` |
+| `ESP_PSRAM64H.sv` | retroSoC retained Mini model, moved for Tiny R2-P8 shared verification | repository history | source-bound in the Tiny P8 snapshot |
 
 The Winbond model retains its upstream copyright and "All Rights Reserved"
 notice. Inclusion here records provenance and does not relicense that model

rtl/tiny/README.md

@@ -94,6 +94,11 @@ require pin-level XPI PSRAM and full-frame readback, not fast-flash or
 separate-controller evidence.
 No camera/PSRAM rate is qualified by this freeze.
 
+The [P8 implementation](../../docs/ip/tiny-soc-r2-psram.md) adds explicit optional
+NSS1 initialization and CPU/DMA mapped-data verification through a shared
+pin-level PSRAM model. It preserves SRAM-only boot and does not integrate DVP.
+The verification ledger owns phase acceptance and remaining qualification gaps.
+
 The separately approved [SPI extension](../../docs/ip/spi.md) adds SPI0 to the
 future standard Tiny product, with its own `SPI-P0` through `SPI-P5` phases.
 It is a PCLK master-only 8/16-bit controller with separate 8 x 32-bit TX/RX