docs(tiny): record P5 reset correction validation

Document corrected reset behavior, source-bound evidence, validation commands and both PDK timing observations. Mark the earlier reset repair as superseded while preserving its historical attribution.

Retain explicit limits for workload replay, full-function netlist testing and physical qualification. Human phase acceptance and P6 execution remain separate.

docs/ip/tiny-soc-r2-concurrent-fabric.md

@@ -5,14 +5,120 @@ This implements the approved P5 preflight on
 `7e19de49d49efaafacccfa85671e314d53dd15a4`. The default is Tiny/ICS55 SAFE24
 with its present PLL parked off; IHP130/no PLL remains compatibility.
 The [ledger](tiny-soc-verification.md) separates phase evidence from approval.
-Functional validation and matched-image measurements are complete for review;
-no P6, frequency or physical qualification is implied.
+Historical campaigns and their limitations remain below. The P1 correction
+has its own source and validation scope; no P6, frequency or physical
+qualification is implied.
+
+## P1 protocol correction (2026-10-11)
+
+This correction starts from committed `4e6ab1a6fb445521703f0bfa412d3a1e8a38cd69`
+and the unchanged frozen specification. The preceding `09-30` campaign's
+`final-evidence.json` records two reset protocol failures and stale publication
+bindings even though ordinary regressions and matched-image replay passed.
+Those results do not qualify this corrected RTL.
+
+Target reset cancels the downstream session while preserving the live
+upstream session. A reset sampled in Address/Response latches the abort path;
+releasing the target cannot replay its cancelled address or data. Already
+captured R/B responses remain in the Common spills with unchanged VALID,
+payload, ID and order. Only fabric/system reset clears those buffers. The
+downstream stability assertions follow the target's own reset; upstream
+stability assertions remain enabled throughout target-only reset.
+
+A nine-bit count tracks captured read beats, including buffered and already
+retired beats. Missing DECERR beats append through the same spill until the
+original ARLEN+1 count is met; RLAST belongs only to the final beat. AbortWrite
+accepts/discards remaining upstream W beats before creating one DECERR B.
+Captured-B state prevents duplicate responses and preserves an already held
+successful completion. Fault metadata is captured from the first erroneous
+response beat, preserving earlier SLVERR over a subsequent reset DECERR;
+fault counting remains once per terminal transaction. Fully captured successful
+responses do not become reset faults.
+
+The reset fixture drives stimulus away from sampling edges and independently
+checks R/B stability, exact beat counts, W-before-B ordering, one completion,
+credit release and first-error metadata. Its 28 cases include 16-beat SRAM/XPI
+traffic, a production APB bridge, three production DMA-master drain cases,
+target reset held through completion and early target release. A separate
+formal mode varies target reset arbitrarily and proves response/ownership,
+beat-count and W/B ordering properties by induction. The normal formal mode
+and its fixed-response expectations remain intact. Publication bindings retain
+complete terminal/fault predicates, with negative tests for premature
+completion and response flushing; the reviewed publication SHA is unchanged.
+
+Evidence belongs under
+`build/ics55-tiny-2026-10-11-23-35-b4aa59f3e5d9/meta/tiny-r2-p5-p1/`.
+Final focused checks precede one full Pytest and one PR execution per Tiny
+PDK. No matched-image replay is required to claim this bounded correctness
+repair; historical workload measurements retain their source attribution.
+Validation completed on 2026-10-12; the ledger retains human review pending.
+Runtime peripheral-reset controls/quiescence remain P7, and the existing
+five-edge reset leaves remain unchanged. No shared DMA, public ABI, profile,
+dependency, warning baseline or metrics policy changes are included.
+
+The final technical input digest is
+`f670789a2379a8d2e6c59f5ecd714ca0237bb6f1cfe749a2f29b0794d356b5f0`.
+`source.json` preserves the 2011 inputs and locked tools; `evidence.json`
+rechecks their identity and binds all gate/fixture/flow artifacts. Focused
+validation passes 101 tests; full Pytest passes 1685 with one optional `pypdf`
+skip and no failures. Counts overlap. ICS55/IHP130 PR commands each ran once;
+their Tiny nightly dry-run matrices match, so the same gates were not repeated.
+All six ordinary simulations satisfy command success, the Tiny success marker
+and forbidden-marker checks. The scoped reset fixture and formal checks are
+additional protocol evidence, not physical or XPI-device qualification.
+
+| PDK / balanced recipe | Cells | Library area | Max WNS / TNS (ns) | Min WNS / TNS (ns) |
+| --- | ---: | ---: | ---: | ---: |
+| ICS55 | 245037 | 1910664.100799 | -70.04 / -1151596.25 | 0 / 0 |
+| IHP130 | 259394 | 9911158.202394 | -127.01 / -3120300.50 | 0 / 0 |
+
+Current physical-flow observations are under
+`build/ics55-tiny-2026-10-11-23-35-42d5beccb726/` and
+`build/ihp130-tiny-2026-10-11-23-35-bff91e3529ba/`, in `meta/metrics.json`
+and `sta/opensta/{timing_metrics.rpt,p4-clock-bindings.rpt,opensta.log}`.
+Both mapping checks retain four groups, 32 macros and CPU/main SRAM on SYS.
+Timing remains observational and unclosed; library area is not routed die area
+and zero observed min violations do not constitute PVT/hold signoff. Lint
+signature/count sets are identical to `09-30` (470/414 new against the unchanged
+ICS55/IHP130 baselines, zero increased). Successful ABC Liberty-cache fallback
+and NFS clock-skew observations remain logged. No baselines were regenerated.
+
+Commands used the locked activation, `BUILD_TIMESTAMP=2026-10-11-23-35` and
+`JOBS=3`. The `run_flow.py` JSON/log pairs in the correction evidence root retain
+every exact command: `focused`, `quality`, `pytest-full`, `regress-ics55`,
+`regress-ihp130`, `metrics-ics55`, `metrics-ihp130`, four `dry-run-*` records
+and `audit-result`. The principal acceptance commands were:
+
+```sh
+source .cache/retrosoc/development/tiny-r2-p1/activate.sh
+export BUILD_TIMESTAMP=2026-10-11-23-35 JOBS=3
+make rtl-format-check rtl-style-check-all rtl-readiness-check-all
+ruff check .
+python3 -m pytest -q --tb=short --basetemp=build/ics55-tiny-2026-10-11-23-35-b4aa59f3e5d9/meta/tiny-r2-p5-p1/tests-full
+python3 scripts/regress.py --root . --suite pr --soc TINY --pdk ICS55
+python3 scripts/regress.py --root . --suite pr --soc TINY --pdk IHP130
+make CONFIG=configs/ci/ics55-tiny.mk SOC=TINY PDK=ICS55 APP=ci_smoke SYNTH=YOSYS STA=OPENSTA metrics
+make CONFIG=configs/ci/ihp130-tiny.mk SOC=TINY PDK=IHP130 APP=ci_smoke SYNTH=YOSYS STA=OPENSTA metrics
+git diff --check
+```
+
+New executions must select a fresh timestamp/evidence directory. New matched
+workload replay, compiler experiments, full-function C netlist qualification,
+PDF build/visual promotion, CDC/RDC, extracted PVT/MMMC and place/route were
+not run. No performance, new operating-frequency or complete-product claim is
+made by this correction. Error completion does not roll back downstream writes
+or peripheral side effects that committed before reset.
 
 ## Target-local reset repair (2026-10-11)
 
+This is the superseded first attempt. Its focused tests passed but omitted
+required protocol checks; the later `09-30` campaign and independent monitors
+rejected it. The following description records that attempted behavior, not
+the corrected implementation above.
+
 The P5 review found that a target reset was previously used only as an
 admission enable while an accepted controller session remained live. The
-fabric now carries the explicit per-target reset leaf into each controller.
+attempt carried the explicit per-target reset leaf into each controller.
 Admission and downstream AXI VALID/W/RREADY are blocked while that leaf is
 asserted. An accepted Address or Response session changes to an abort response
 and returns one DECERR RLAST or B response with the saved owner and ID; the

docs/ip/tiny-soc-verification.md

@@ -1,7 +1,50 @@
 # Tiny MCU Verification Record
 
+## TINY-R2-P5 P1 protocol correction; validated, review pending (2026-10-12)
+
+The maintainer requested correction of the reset write-drain/read-retention
+failures and publication-binding mismatch. The implementation starts from
+`4e6ab1a6fb445521703f0bfa412d3a1e8a38cd69`; the specification remains blob
+`7e19de49d49efaafacccfa85671e314d53dd15a4`. The [P5 runbook](tiny-soc-r2-concurrent-fabric.md)
+describes preserved upstream spill responses, complete read/error bursts,
+write drain before B, latched downstream cancellation and first-error capture.
+Profiles remain Tiny/ICS55 SAFE24 with parked PLL and Tiny/IHP130 compatibility.
+
+Current evidence is isolated under
+`build/ics55-tiny-2026-10-11-23-35-b4aa59f3e5d9/meta/tiny-r2-p5-p1/`.
+The older `09-30` campaign failed overall: 1669 Pytest passes, one skip,
+two failures and ten errors (publication), plus independent R stability and
+W-before-B violations. Its passing ordinary regressions, PPA and replay are
+historical observations, not acceptance of the repair.
+
+Final focused validation passes 101 tests. Full Pytest passes 1685 tests,
+with one optional `pypdf` skip and no failures; these counts overlap. Both
+Tiny PDK PR regressions pass, including six strict simulation verdicts,
+synthesis, netlist boot and the 32-macro/common-SYS binding check. Each
+simulator passes all 28 reset scenarios, including three production DMA
+drain cases; normal-target, arbitrary-target-reset and fault-collector
+induction/SAT checks pass. Complete terminal/fault publication bindings and
+three unsafe-completion mutation tests pass without changing the reviewed
+publication SHA. RTL format/style/readiness, Ruff and diff checks pass.
+
+`source.json` and `evidence.json` bind 2011 technical inputs to digest
+`f670789a2379a8d2e6c59f5ecd714ca0237bb6f1cfe749a2f29b0794d356b5f0`,
+locked tools, exact command results and retained artifacts. No warning
+baseline, metric policy, shared DMA/SDK implementation or public ABI changed.
+The lint signatures/counts match the preceding `09-30` campaign; the existing
+baseline comparison remains a non-blocking observation. STA remains unclosed:
+max WNS is -70.04 ns ICS55 and -127.01 ns IHP130. The runbook records full
+area/timing observations and limitations. Matched-image replay, full-function
+C netlist qualification, PDF promotion and physical qualification were not
+repeated for this bounded correctness repair. P5 human review/acceptance and
+all P6+ work remain separate.
+
 ## TINY-R2-P5 target-reset isolation repair; focused validation (2026-10-11)
 
+Superseded attempt: later protocol checks rejected its response flushing and
+early B/RLAST behavior. The four focused passes below remain historically
+accurate but were insufficient to establish reset isolation.
+
 Following the P5 review, the fabric now receives the explicit 23-entry target
 reset vector. A reset blocks new admission and downstream handshakes, flushes
 response spill state, and converts any accepted target session into a held