diff --git a/Makefile b/Makefile
index 72d1ab2b..f38c1217 100644
--- a/Makefile
+++ b/Makefile
@@ -576,7 +576,7 @@ help:
 	  '  npu-p5-host                run compiler, generated-C, executor, and ABI tests' \
 	  '  npu-p5-rtl                 run frozen model inputs through Icarus and Verilator' \
 	  '  npu-p5-lp-sim              run LP interrupt bare-metal NPU acceptance' \
-	  '  npu-p5-hp-sim              run HP polling/Zicbom bare-metal NPU acceptance' \
+	  '  npu-p5-hp-sim              run HP polling/XTheadCmo bare-metal NPU acceptance' \
 	  '  npu-p5-report              validate and assemble retained P5 evidence' \
 	  '  npu-p6-corpus              build deterministic 100-case qualification shards' \
 	  '  npu-p6-formal              close DMA, context, and control bounded proofs' \
diff --git a/app/README.md b/app/README.md
index fae63e58..e627db77 100644
--- a/app/README.md
+++ b/app/README.md
@@ -33,7 +33,7 @@ The build selects an application with `APP=<name>`. The supported profiles are:
 | `coremark` | SRAM-resident Hazard3 CoreMark measurement; use the committed quick or standard profile. |
 | `debug` | Minimal SRAM image used only by the Hazard3 OpenOCD/GDB acceptance flow. |
 | `hp_boot` | SRAM-resident LP loader that validates typed V2 Linux, smoke or RT-Thread bundles, loads SDRAM, releases HP, and monitors the workload-specific mailbox verdict. |
-| `apu_release` | PSRAM-resident LP/HP APU evidence flow: LP-only microcode/KWS model load, ownership handoff to RV64 HP, HP-submitted WAV/KWS jobs with Zicbom maintenance, and LP-only register fault probe. |
+| `apu_release` | PSRAM-resident LP/HP APU evidence flow: LP-only microcode/KWS model load, ownership handoff to RV64 HP, HP-submitted WAV/KWS jobs with T-Head XTheadCmo dcache maintenance, and LP-only register fault probe. |
 | `shell` | Interactive application that adds shell services, board drivers, media, FatFs, CoreMark, and UserIP integration. |
 | `xpi_flash_loader` | SRAM-resident, GDB-called service image for sector-preserving JTAG programming of the qualified NSS0 NOR. |
 
@@ -46,7 +46,7 @@ NPU-P5 acceptance extends existing compositions rather than adding an APP.
 of the reproducible variant key. The LP path links the generated KWS plan into
 `ci_smoke`, uses the real LP completion interrupt, and writes the normal
 SYSCTRL verdict. The RV64 HP smoke bundle assigns resource 9 to hart 1, runs
-the same plan with polling and 64-byte Zicbom maintenance, then returns
+the same plan with polling and 64-byte T-Head XTheadCmo dcache maintenance, then returns
 ownership before LP publishes the final verdict. The option defaults to `NO`,
 preserving normal PR firmware size and behavior.
 
diff --git a/configs/README.md b/configs/README.md
index c0f19a12..403283bc 100644
--- a/configs/README.md
+++ b/configs/README.md
@@ -22,10 +22,10 @@ and retained logs under
 `build/ihp130-2026-10-01-10-30-b2e490436ac7/npu/p6/`.
 `ci/ihp130-hp.mk` is the asymmetric Linux application profile. It starts HP
 from the external 72 MHz safe clock and LP from REF24, runs `hp_boot` entirely
-from 32 KiB on-chip SRAM, enables VexiiRiscv `Zicbom` with 64-byte blocks, and
-generates VexiiRiscv RTL only below the selected build variant. It is not part
-of the supported PR matrix until Linux boot, HP performance, synthesis, and
-timing evidence are qualified.
+from 32 KiB on-chip SRAM, and uses the locked pre-generated OpenC906 HP core
+(RV64GC, hart 1) whose combined RTL is emitted only below the selected build
+variant. It is not part of the supported PR matrix until Linux boot, HP
+performance, synthesis, and timing evidence are qualified.
 `ci/ihp130-rtthread.mk` selects the same RV64 HP hardware and LP loader for
 the pinned RT-Thread M-mode selftest. Run `make setup-hp-rtthread`, then
 `make CONFIG=configs/ci/ihp130-rtthread.mk SIMU=VERILATOR hp-rtthread-sim`.
@@ -34,7 +34,10 @@ the pinned RT-Thread M-mode selftest. Run `make setup-hp-rtthread`, then
 SDRAM, performs the LP-only image loads, hands APU ownership to HP, and checks
 HP-submitted WAV/KWS jobs plus the LP-only register fault probe in the full-SoC
 Verilator simulation via `hp-apu-sim`.
-All PRODUCT profiles use `rv64imafdc_zicbom_max`; LP compiler/ISA remain RV32.
+Mini PRODUCT profiles use the locked OpenC906 HP core (RV64GC); HP images
+compile as `rv64imafdc_zicsr_zifencei`/`lp64d`, and the former
+`rv64imafdc_zicbom_max` VexiiRiscv configuration is preserved as the
+Std-series generator asset. LP compiler/ISA remain RV32.
 `ci/ihp130-xpi-flash-loader.mk` builds the SRAM-only XPI NOR service image used
 by GDB/OpenOCD; it is a programming utility, not a normal boot application.
 Start builds from a committed profile rather than setting an unreviewed mix of
diff --git a/scripts/README.md b/scripts/README.md
index 44b9e027..d905f607 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -125,6 +125,16 @@ SRAM CoreMark quick report into `meta/coremark.json`; it requires one valid
 `COREMARK_RESULT` record and `COREMARK_PASS`. Both reports complement, rather
 than replace, the common `SIM_TEST_PASS` simulation verdict.
 
+`setup_openc906.py` installs or updates (`--update`) the locked OpenC906
+source used by Mini product profiles and verifies the checked-out revision;
+the vendored checkout is never modified. `generate_openc906.py` resolves the
+upstream `C906_RTL_FACTORY/gen_rtl` filelists from that checkout, substitutes
+the reviewed overrides from `rtl/mini/ip_overrides/` (the hart-1
+`aq_sysio_kid.v` and the strong-order MMIO-window `sysmap.h`, each pinned to
+the upstream file's SHA-256 so a locked-revision move forces review), and
+emits the single compilation unit `openc906_combined.v` below `build/`;
+generated RTL is never tracked.
+
 `generate_vexiiriscv.py` verifies the locked VexiiRiscv revision, rejects local
 source changes before and after generation, and generates the fixed Std-series
 core (preserved from the retired Mini HP configuration) below `build/`; generated
diff --git a/scripts/npu_p5_report.py b/scripts/npu_p5_report.py
index 67d3a032..5d56f187 100644
--- a/scripts/npu_p5_report.py
+++ b/scripts/npu_p5_report.py
@@ -450,7 +450,7 @@ def main() -> int:
                 "softmax_cycles": int(marker.group(4)),
                 **lp_evidence},
             "hp": {"result": str(args.hp_result), "check": str(args.hp_check),
-                "command": hp["command"], "mode": "polling-zicbom",
+                "command": hp["command"], "mode": "polling-xtheadcmo",
                 **hp_evidence},
             "summary": {
                 "required_checks": 47,