docs: refactor Tiny SoC documentation and integrate ICS55 PLL support

- Updated tiny-soc.md to reflect the 2026-10-07 refreeze, establishing ICS55 as the default target PDK with HAVE_PLL=YES. - Added detailed sections on final timing gate policies, PLL integration, and execution order for Tiny SoC. - Modified soc-family-positioning.md to indicate the new default target for Tiny as ICS55/PLL while maintaining IHP130 compatibility. - Enhanced pdk/README.md and setup.py to support the integration of the locked ICS55 PLL views, including setup commands and validation. - Introduced tests for the ICS55 PLL dependency to ensure proper integration and validation of PLL views. - Updated rtl/tiny/README.md to clarify the current executable baseline and the pending integration of ICS55.
2026-11-04 22:32:36 +00:00 · 2026-10-07 19:24:55 +08:00
1 parent 14a253a49a
commit ecac3559b0
@@ -77,8 +77,11 @@ README that states its ownership, source of truth, and validation expectations.
  `bringup`, `debug`, and `shell`; each profile is declared in
  `app/apps/<name>/app.mk`. The `debug` application is an RTL debug-transport
  acceptance image, not a user-facing firmware profile.
- Tiny is a distinct wired MCU product under `rtl/tiny`; `SOC=TINY` selects its
-  IHP130 profile and AXI4/APB4 integration.
+- Tiny is a distinct wired MCU product under `rtl/tiny` with AXI4/APB4 integration.
+  Its 2026-10-07 specification default is ICS55 with `HAVE_PLL=YES` and SAFE24
+  boot; TINY-ICS55-P1 executable integration is pending. The current committed
+  Tiny profile remains IHP130/no PLL. Do not confuse target defaults with
+  implemented configuration or change Mini defaults.
 - Do not add new dependencies on `crt/inc`, retired SDK `tiny` names, or legacy
  `rs_*.h`/`tiny*.h` include paths.
 - Treat `app/coremark/coremark-main`, `app/fatfs/ff16`, `app/lvgl/lvgl-main`,
@@ -173,6 +176,14 @@ warning checks, and metric collection.
  not evidence that the simulation has failed.
 ## Before Hand-off

+For Tiny/SPI/PIO-lite/PPALite, apply the 2026-10-07 policy in
+`docs/ip/tiny-soc.md`: pre-final post-synthesis timing is observational, with
+attempted/failed/unrun evidence retained. Functional, protocol, source-integrity,
+synthesis/mapping and netlist-function checks remain required. Timing closure
+is mandatory in the final combined complete-product campaign only. This does
+not alter global warning/metric policy, waive missing physical evidence, or
+permit advertising an unqualified operating point.
+
 1. State the selected profile and commands run.
 2. Summarize code, configuration, and public-interface changes separately.
 3. Report validation results, applicable MISRA deviations, and explicitly
@@ -125,7 +125,7 @@ points, not the complete profile or application inventory.
 | [IHP130 Tiny](configs/ci/ihp130-tiny.mk) | Single-hart wired MCU, 128 KiB SRAM, pin-level Flash boot and automated acceptance. |
 | [IHP130 Mini](configs/ci/ihp130.mk) | Manual bring-up with 32 KiB macro-backed SRAM. |
 | [GF180](configs/ci/gf180.mk) / [SKY130](configs/ci/sky130.mk) | Alternative PDK profiles with 32 KiB macro-backed SRAM. |
-| [ICS55](configs/ci/ics55.mk) | Regression-compatible profile with SRAM and PLL disabled. |
+| [ICS55 Mini](configs/ci/ics55.mk) | Regression-compatible Mini profile with locked SRAM and PLL disabled. |
 | [Interactive shell](configs/ci/ihp130-shell.mk) | Shell firmware with CSR support enabled. |
 | [Hazard3 debug](configs/ci/ihp130-debug.mk) | JTAG acceptance using Verilator, OpenOCD, and GDB. |
 | [HP Linux](configs/ci/ihp130-hp.mk) | LP RV32IM / HP RV64IMAFDC Linux image/bundle flow and HP RTL validation; outside the supported PR matrix. |
@@ -134,6 +134,13 @@ points, not the complete profile or application inventory.
 | [CoreMark](configs/benchmark/ihp130-hazard3-coremark.mk) | Fixed LP SRAM benchmark with the RV64 product HP core present. |
 | [Mini MPW](configs/cluster/mini-mpw.mk) | Legacy MPW C0-C3/user-IP compatibility, separate from the product ABI. |

+Tiny's [2026-10-07 target refreeze](docs/ip/tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07)
+selects ICS55 with `HAVE_PLL=YES` and SAFE24 startup as the future default.
+Its new profile and RTL binding await TINY-ICS55-P1; the IHP130 Tiny entry above
+remains the executable compatibility baseline. Locked PLL views can be acquired
+with `python3 physical/pdk/setup.py --pdk ICS55 --component pll` independently
+of platform implementation or timing qualification.
+
 After the corresponding setup, use these common commands:

 ```sh
@@ -43,10 +43,10 @@ variables on the command line.
 `SRAM_SIZE_KIB` selects 4, 16, 32, 64, or 128 KiB of on-chip SRAM and is part
 of the build variant key. IHP130, GF180, and SKY130 CI profiles select eight
 4 KiB banks for 32 KiB total and enable both the interface and technology
-macro. The committed ICS55 profile now uses the locked OpenECOS SRAM release;
-its PLL remains absent. All committed
-product and benchmark profiles use 32 KiB; larger capacities remain valid
-manual values but are not selected by the product profiles.
+macro. The committed ICS55 Mini profile now uses the locked OpenECOS SRAM
+release; its PLL remains absent. Capacity is selected by each committed
+profile: the executable IHP130 Tiny profile uses 128 KiB. Do not infer a
+Tiny capacity or PLL setting from a Mini profile.

 `local/ics55.example.mk` remains available for an optional PLL experiment.
 The committed ICS55 SRAM models are downloaded and verified by the PDK setup
@@ -66,6 +66,12 @@ For supported profiles and commands, see the root [README](../README.md) and

 ## Tiny MCU

+The [2026-10-07 Tiny refreeze](../docs/ip/tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07)
+sets the **target** default to ICS55 with `HAVE_PLL=YES` and SAFE24 boot.
+`ci/ics55-tiny.mk` is planned for TINY-ICS55-P1 and is not yet an executable
+profile. IHP130 remains explicit compatibility; do not substitute the Mini
+`ci/ics55.mk` profile for Tiny or bypass current configuration guards.
+
 `ci/ihp130-tiny.mk` selects `SOC=TINY`, one RV32IMC Hazard3 (A disabled),
 128 KiB SRAM, AXI32/APB4, four DMA channels and the wired peripheral subset.
 The profile uses 24 MHz, `HAVE_HP=NO`, `MINI_MODE=NONE`, CSR-enabled RV32IM
@@ -23,6 +23,17 @@ python3 scripts/dependency_lock.py --lock dependencies/dependencies.lock.json
 Then run the affected setup, doctor, test, and regression flow described in
 [Engineering Workflow](../docs/engineering.md).

+`sources.pdk_ics55_pll` locks OpenECOS `PLL_V02p1` at
+`6ebb1a8f7f4ccbccdb7f587664fdfe63cd39e61b`. Restore only its seven integration
+views with `python3 physical/pdk/setup.py --pdk ICS55 --component pll`, or as
+part of normal ICS55 PDK setup (`--component all`, the default). The checkout
+is `.cache/retrosoc/sources/ics55_ecos_pll`, outside replaceable Liberty caches.
+Setup reports its revision and per-file SHA-256 values and refuses dirty or
+unexpected checkouts under the usual update policy. The upstream license is
+undetermined (`NOASSERTION`); Liberty lacks timing arcs and the macro has no
+LOCK output. Acquisition neither selects the macro in a profile nor qualifies
+PLL behavior, timing or release. Tiny platform integration remains pending.
+
 The locked SKY130 OpenRAM SRAM archive is generated and published by the
 `retroSoC/artifact` workflow. `physical/pdk/setup.py` verifies its SHA-256,
 manifest, geometry, source revisions, generated-file hashes, and TT/SS views
@@ -125,6 +125,12 @@
      "recursive": true,
      "license": "Apache-2.0"
    },
+    "pdk_ics55_pll": {
+      "url": "https://github.com/openecos-projects/ics55_ecos_pll.git",
+      "revision": "6ebb1a8f7f4ccbccdb7f587664fdfe63cd39e61b",
+      "destination": ".cache/retrosoc/sources/ics55_ecos_pll",
+      "license": "NOASSERTION"
+    },
    "pdk_gf180": {
      "url": "https://github.com/google/gf180mcu-pdk.git",
      "revision": "de3240d7529a6970437ac3344820aaae7839f215",
@@ -2,6 +2,15 @@

 ## Supported Profiles

+Tiny's [2026-10-07 specification default](ip/tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07)
+is ICS55/PLL with SAFE24 boot; platform enablement and its new profile remain
+pending. The table describes executable profiles, not planned support.
+For Tiny and its SPI/PIO-lite/PPALite extensions only, pre-final post-synthesis
+timing closure is observational. Retain STA attempts/failures and all required
+functional, synthesis/mapping and netlist-function evidence. The combined
+complete-product final campaign retains hard timing/physical acceptance.
+This does not change warning/metrics policy or another product's gates.
+
 | Tier | Profile | Automated coverage |
 | --- | --- | --- |
 | Pull request | `configs/ci/ihp130-tiny.mk` | Tiny firmware, Verilator/Icarus, lint; local Yosys, netlist and OpenSTA |
@@ -9,6 +9,16 @@ automatically cover the new feature.

 ## Configuration and Evidence Identity

+- Current normative default: TINY/ICS55, `HAVE_PLL=YES`, SAFE24 boot under the
+  [2026-10-07 Tiny policy](tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07).
+  TINY-ICS55-P1 and `configs/ci/ics55-tiny.mk` are pending. The profile below
+  remains executable IHP130 compatibility, not an ICS55 test result.
+- All pre-final post-synthesis timing is observational. Retain failed/unrun
+  measurements and functional/protocol, synthesis/mapping and netlist-function
+  gates. PIOLITE-P5 joins R2-P11/SPI-P5/PPALITE-P5 only after all functional
+  stages, with mandatory final timing closure on one complete-product netlist.
+  Existing phase names and historical evidence retain their original identity.
+
 - Starting profile: `configs/ci/ihp130-tiny.mk`, TINY, IHP130, 24 MHz/no PLL,
  current four-channel DMA and no PIO-lite.
 - Planned integration: two SMs, shared 32x16 IMEM, per-SM TX/RX 8x32, PCLK
@@ -21,8 +31,8 @@ automatically cover the new feature.
  logs, structured verdict and observed gaps. Artifacts belong below the
  repository's `build/<profile>-<date-time>-<config-hash>/` layout.
 - Shared Mini regressions validate compatibility only: PIO ports and support
-  bits remain disabled there. Full-chip P5 and R2-P11 evidence can be shared
-  only for the same PIO-inclusive source/netlist/configuration.
+  bits remain disabled there. P5, R2-P11, SPI-P5 and PPALITE-P5 close together
+  only on the same complete-product source/netlist/configuration.

 ## Requirement Matrix

@@ -110,8 +120,10 @@ P1 uses Ruff and Pytest for the new model/assembler. P2 adds discovered tests
 and the existing lint/style/formal/synthesis mechanisms; test names and build
 entries are created in that implementation phase, not invented as working
 commands here. P3/P4 use the main contract's SDK/firmware/regression commands
-and focused DMA/GPIO/PIO tests. P5 follows the existing IHP130 physical-flow
-procedure with the frozen full-source variant and required collateral.
+and focused DMA/GPIO/PIO tests. P5 joins the selected-PDK complete-product
+physical campaign with frozen full-source inputs and required collateral;
+the ICS55 Tiny full-chip adapter remains pending, and existing IHP130 flows
+are compatibility-only evidence.

 For Tiny firmware, success requires command exit 0, the configured
 `SIM_TEST_PASS`, and no `FAILED`, `FATAL`, `assertion failed`, `%Error`,
@@ -20,9 +20,21 @@ firmware, configuration, dependency, warning baseline or quality-policy change.

 ## Target SoCs and Integration Scope

+The [2026-10-07 Tiny refreeze](tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07)
+selects default TINY/ICS55, `HAVE_PLL=YES`, SAFE24 boot, retaining explicit
+IHP130 compatibility. `configs/ci/ics55-tiny.mk` remains planned until
+TINY-ICS55-P1; commands below are existing IHP130 references. Pre-final
+post-synthesis timing is observational, while functionality, protocol,
+synthesis/mapping and netlist-function checks remain required. PIOLITE-P5
+joins R2-P11, SPI-P5 and PPALITE-P5 after all functional stages on the same
+complete-product netlist. Preserve phase IDs/titles and historical evidence;
+titles containing IHP130 retain their names with this updated default scope.
+PIO implementation and unrelated dependency changes remain outside this refreeze.
+
 | Item | Frozen boundary |
 | --- | --- |
 | Target | TINY, future standard QFN64 product feature |
+| Default target / planned profile | ICS55, `HAVE_PLL=YES`, SAFE24 boot; `configs/ci/ics55-tiny.mk` pending TINY-ICS55-P1 |
 | Starting profile / PDK | `configs/ci/ihp130-tiny.mk` / IHP130; existing 24 MHz, no-PLL baseline |
 | Product integration | `rtl/tiny/top/retrosoc_tiny.sv`, `rtl/tiny/integration/soc_topology.json`, `rtl/tiny/address_map/memory_map.json`, `rtl/tiny/pin_map/pin_map.json`, `rtl/tiny/integration/clock_reset_domains.json` |
 | Filelists | `rtl/tiny/filelist/ip.fl`, `inc.fl`, `top.fl`, `tb.fl` and their existing build flow |
@@ -31,7 +43,7 @@ firmware, configuration, dependency, warning baseline or quality-policy change.
 | Interrupt / RCU target | Tiny CPU IRQ24 / Tiny RCU target 15; not a family-wide assignment |
 | DMA | Requests 14/TX and 15/RX through central DMA V2.1; no new memory master |
 | Pads | Existing GPIO0..31 through GPIO `USER_SELECT`; no new ALT encoding, Pad or package terminal |
-| Clocks | PCLK 24 baseline, PCLK 48/60 targets after applicable R2 enablement and qualification |
+| Clocks | PCLK 24 baseline, PCLK 48/60 functional targets after R2 platform enablement; physical qualification only in the final campaign |
 | Deferred products | MINI, STD, PRO and any four-SM product configuration |

 Mini requires compatibility testing of shared DMA/GPIO changes but does not
@@ -536,7 +548,8 @@ in PCLK. SM division is an enable, not a generated-clock constraint. GPIO
 already owns input synchronization; CPU APB and DMA memory domain crossings
 remain the existing Tiny bridges. No additional CDC is hidden in a PIO route.
 PIO consumes the actual RCU PCLK rate; CPU/main SRAM SYS and XPI MEM are not
-substitutes. PCLK 24 is the starting environment;48/60 require R2 qualification.
+substitutes. PCLK 24 is the starting environment; 48/60 functional tests require
+R2 clock/platform implementation, not intermediate physical qualification.

 | Operation/state | Required behavior |
 | --- | --- |
@@ -693,7 +706,8 @@ need their own reviewed record. Existing excluded/managed code remains excluded.

 ## Synthesis, Timing, and Physical Evidence

-For TINY/IHP130, record source SHA, lock/config digest, variant, PCLK/SYS/MEM,
+For default TINY/ICS55 or explicit IHP130 compatibility, record source SHA,
+lock/config digest, variant, PCLK/SYS/MEM,
 program binaries, pin loads and enabled endpoints for every result. Required
 evidence includes block and full-SoC synthesis, register/IMEM/FIFO mapping,
 area/cell count, activity-based power, WNS/TNS, reset fanout and release,
@@ -707,8 +721,9 @@ simultaneous switching, board constraints and QFN64 routing. Structural DFT
 and local-storage test coverage must be reviewed; no SRAM MBIST/ECC or silicon
 qualification is claimed for these register arrays.

-P5 may share a campaign with TINY-R2-P11 after applicable R2 system tests, but
-both must identify the same PIO-inclusive source/netlist/configuration. Earlier
+P5 must join TINY-R2-P11, SPI-P5 and PPALITE-P5 in the final campaign after all
+applicable functional/system tests. All must identify the same complete-product
+source/netlist/configuration. Earlier
 R2 qualification does not cover added storage, routing, reset load or pads.
 Missing macro/Pad views, vendor models, licensed tools and board/silicon access
 remain explicit gaps, not waived requirements.
@@ -726,14 +741,14 @@ authorized or marked complete by approval of this document.
 | PIOLITE-P2 - Core and Register Implementation | P1; implement owned hierarchy/APB/ISA, FIFOs, guard/adapters at standalone interfaces, handwritten SVH/C parity and testbench/assertions. Model-differential, directed/random/formal, lint/style and block-synthesis evidence; no false integrated capability. |
 | PIOLITE-P3 - Tiny GPIO and DMA Integration | P2 plus applicable TINY-R2-P6/P7 and inherited fabric prerequisites; change topology/address/IRQ/RCU/filelists, GPIO sidebands and HAL, DMA V2.1 capability/grants/cancellation. Validate clock/reset ownership, full drain/recovery and unaffected Mini using targeted tests, SDK checks and affected firmware/simulations. |
 | PIOLITE-P4 - SDK and Application Qualification | P3; finish freestanding loader/session/example library and all three bringup groups, exact counts/tails, independent BFMs, contention/long-duration/error recovery and complete Tiny regressions. No rate claim without current-program evidence. |
-| PIOLITE-P5 - IHP130 Timing and Physical Qualification | P4 plus applicable R2-P10 system evidence; full-source synthesis/netlist/STA/CDC/RDC/physical/pad campaign, optionally joint R2-P11. Close or explicitly block each release gate; report measured rates/area/power, not vendor-derived values. |
+| PIOLITE-P5 - IHP130 Timing and Physical Qualification | Historical title; default ICS55. P4 plus all product functional prerequisites; mandatory final campaign with R2-P11/SPI-P5/PPALITE-P5 on one complete netlist. Close or explicitly block synthesis/netlist/STA/CDC/RDC/physical/pad gates; report measured rates/area/power. |

 ### Next-phase preflight handoff

 ```text
 Use $retrosoc-feature-implementation. Stage: preflight. Feature slug: piolite. Target SoCs: TINY.
 Phase: PIOLITE-P1 - ISA Reference Model and Assembler.
-Read docs/ip/piolite.md and docs/ip/piolite-verification.md. The executable starting profile is configs/ci/ihp130-tiny.mk, PDK IHP130, 24 MHz/no PLL; it has no PIO integration yet.
+Read docs/ip/piolite.md and docs/ip/piolite-verification.md. Default target: ICS55/HAVE_PLL=YES with SAFE24 boot and planned configs/ci/ics55-tiny.mk; require accepted TINY-ICS55-P1 before integrated default-platform work. Current executable reference: configs/ci/ihp130-tiny.mk, IHP130, 24 MHz/no PLL, no PIO. Apply the 2026-10-07 observational pre-final timing policy and mandatory complete-product final campaign; do not invent an executable profile or relabel historical results.
 Plan only the frozen ISA reference model, deterministic assembler, program metadata/relocation and focused tests, including actual 32-word application and dual-SM footprints. Preserve the two-SM architecture, PCLK tick/packing semantics, GPIO/DMA lifecycle contracts and all R2 phase identifiers.
 Do not implement RTL, HAL integration, DMA V2.1, GPIO/RCU wiring, new profiles or later phases. Do not alter the ISA/ABI, expand memory or package scope, download new dependencies, change quality policy, commit or push. Report SPEC_CONFLICT if a frozen requirement cannot be met; do not weaken it. Return the scoped preflight and validation plan for explicit approval before implementation.
 ```
@@ -8,6 +8,17 @@ evidence under its original scope.

 ## Configuration and Evidence Identity

+- Current normative default: TINY/ICS55, `HAVE_PLL=YES`, SAFE24 boot under the
+  [2026-10-07 Tiny policy](tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07).
+  TINY-ICS55-P1 and `configs/ci/ics55-tiny.mk` are pending; existing IHP130
+  commands and historical records are compatibility evidence only.
+- Pre-final post-synthesis timing is observational; failed/missing timing does
+  not become a PASS or a hardware-frequency claim. Source correctness,
+  functionality, synthesis/mapping and netlist-function requirements remain.
+  PPALITE-P5 joins R2-P11/SPI-P5/PIOLITE-P5 after all functional phases on the
+  same complete-product source/config/PDK/netlist, with final timing closure
+  mandatory. Preserve every phase ID/title and prior evidence attribution.
+
 - Starting profile: `configs/ci/ihp130-tiny.mk`, TINY, IHP130, 24 MHz/no PLL,
  four-channel current DMA and no PPALite integration.
 - Future target: APB `0x1001E000`, IRQ27, RCU17, PCLK pixel processing after
@@ -135,8 +146,9 @@ firmware, simulator and regression entrypoints. Both Verilator and Icarus
 exercise the relevant stream/camera/memory paths. Tiny success requires exit 0,
 TEST_STATUS/`SIM_TEST_PASS` and no `FAILED`, `FATAL`, `assertion failed`,
 `%Error`, `SIM_TEST_FAIL` or `SIM_TEST_TIMEOUT`. UART is diagnostic only.
-Preserve each Mini test's own configured verdict. P5 uses the existing
-source-bound IHP130 physical workflow and declared collateral.
+Preserve each Mini test's own configured verdict. P5 joins the source-bound
+selected-PDK complete-product physical campaign. The ICS55 Tiny full-chip
+adapter and qualification remain pending; IHP130 results retain their own PDK.

 ## Freeze Record and Remaining Gaps

@@ -22,9 +22,21 @@ PPALite. Source qualification gaps below remain explicit prerequisites.

 ## Target SoCs and Integration Scope

+The [2026-10-07 Tiny refreeze](tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07)
+selects default TINY/ICS55, `HAVE_PLL=YES`, SAFE24 boot, retaining IHP130
+compatibility. `configs/ci/ics55-tiny.mk` is planned, not executable until
+TINY-ICS55-P1. Existing commands below retain their IHP130 scope. Pre-final
+post-synthesis timing is observational; source integrity, functionality,
+protocol, synthesis/mapping and netlist-function gates are unchanged.
+PPALITE-P5 joins R2-P11, SPI-P5 and PIOLITE-P5 after all functional stages on
+one complete-product netlist. Phase IDs/titles, including historical IHP130
+titles, and prior evidence remain intact. No processor integration is delivered
+by this platform/timing refreeze.
+
 | Item | Frozen boundary |
 | --- | --- |
 | Target / deferred products | TINY future standard product; MINI/STD/PRO integration deferred |
+| Default target / planned profile | ICS55, `HAVE_PLL=YES`, SAFE24 boot; `configs/ci/ics55-tiny.mk` pending TINY-ICS55-P1 |
 | Starting profile / PDK | `configs/ci/ihp130-tiny.mk`, IHP130, existing 24 MHz/no-PLL baseline |
 | Product ownership | `rtl/tiny/top`, `rtl/tiny/integration/soc_topology.json`, `rtl/tiny/integration/clock_reset_domains.json`, `rtl/tiny/address_map/memory_map.json` and existing product filelists |
 | Shared source | `rtl/ip/multimedia/axi4s_dvp.sv`, `dvp_core.sv`, `dvp_reg.sv`; DVP V2 APB/stream contract and existing 512 B payload CDC FIFO |
@@ -662,20 +674,22 @@ source gaps and unavailable tools/models remain visible failures or unrun gates.

 ## Synthesis, Timing, and Physical Evidence

-Bind every result to source SHA, dependency/configuration digests, TINY/IHP130
+Bind every result to source SHA, dependency/configuration digests, default
+TINY/ICS55 or explicit TINY/IHP130 compatibility
 variant, PCLK/SYS/MEM/PIXCLK, geometry/format/phase, source/target models,
 burst limits and board assumptions. Require block/full synthesis, actual small
 storage mapping, area/cells, activity-based power, reset release/fanout,
 netlist simulation, CDC/RDC, PVT/MMMC and extracted timing.

 PCLK24 is the baseline environment, not existing PPALite timing proof. PCLK48/60
-requires R2 clock/platform qualification; PPALite does not qualify CPU/main-SRAM
+functional tests require R2 clock/platform implementation, not intermediate
+physical qualification; PPALite does not qualify CPU/main-SRAM
 192/240 MHz. DVP input Pad timing, camera clock/lifecycle and XPI/PSRAM source-
 bound performance remain separate gates even though no new Pad is added.
 Review DFT/local-storage test coverage without inventing SRAM MBIST/ECC claims.

-PPALITE-P5 may join R2-P11, PIOLITE-P5 and SPI-P5 only on the same complete
-PPALite-inclusive source/netlist/configuration and all required evidence.
+PPALITE-P5 must join the final R2-P11, PIOLITE-P5 and SPI-P5 campaign on the
+same complete-product source/netlist/configuration with all required evidence.
 Earlier netlists do not cover new routing, storage, reset or timing load.
 Missing macro/Pad/clock/vendor/board inputs remain explicit qualification gaps;
 metrics stay observe-mode and warning baselines are not waived by this freeze.
@@ -692,14 +706,14 @@ PPALite there. IDs and titles are stable and do not replace earlier roadmaps.
 | PPALITE-P2 - DVP Route and Source Qualification | P1; coherent source guards, RAW bypass, route/barrier/epoch behavior and DVP correctness prerequisites. Close minimal shared error/statistic/snapshot/CDC/drain defects or reuse accepted fixes, retaining DVP ABI/FIFO and Mini behavior. Source integrity must be proved, not inferred from PPA output. |
 | PPALITE-P3 - Tiny DMA RCU and SDK Integration | P2 plus applicable R2-P6/P7; APB/IRQ27/RCU17/topology/filelists, exact direct DMA2 admission, complete-job drain, capability and bounded HAL. Existing DMA cancellation obligations are prerequisites; no new DMA encoding/master/channel. Target firmware and affected Tiny/Mini tests pass. |
 | PPALITE-P4 - Camera Memory and Display Qualification | P3 plus R2-P8/P9 and display's applicable SPI stages; SRAM/PSRAM captures, pixel/padding/canary checks, SD/stride-aware preview, repeated/error recovery, both simulators, full regressions and measurements. No continuous-video or FPS guarantee without separate evidence. |
-| PPALITE-P5 - IHP130 Timing and Physical Qualification | P4 plus applicable complete-product prerequisites; source-bound full synthesis/netlist/STA/CDC/RDC/physical/power/Pad campaign, optionally shared with existing final gates on the identical inclusive design. |
+| PPALITE-P5 - IHP130 Timing and Physical Qualification | Historical title; default ICS55. P4 plus all product functional prerequisites; mandatory final campaign with R2-P11/SPI-P5/PIOLITE-P5 on the identical complete-product design, closing source-bound synthesis/netlist/STA/CDC/RDC/physical/power/Pad gates. |

 ### Next-phase preflight handoff

 ```text
 Use $retrosoc-feature-implementation. Stage: preflight. Feature slug: ppalite. Target SoCs: TINY.
 Phase: PPALITE-P1 - Stream Pixel Core and Reference Model.
-Read docs/ip/ppalite.md and docs/ip/ppalite-verification.md. The executable starting profile is configs/ci/ihp130-tiny.mk, PDK IHP130, 24 MHz/no PLL; it has no PPALite integration yet.
+Read docs/ip/ppalite.md and docs/ip/ppalite-verification.md. Default target: ICS55/HAVE_PLL=YES with SAFE24 boot and planned configs/ci/ics55-tiny.mk; require accepted TINY-ICS55-P1 before integrated default-platform work. Current executable reference: configs/ci/ihp130-tiny.mk, IHP130, 24 MHz/no PLL, no PPALite. Apply the 2026-10-07 observational pre-final timing policy and mandatory complete-product final campaign; do not invent an executable profile or relabel historical results.
 Plan only the frozen standalone pixel/stream core, input validation, 1/2/4 sampling, exact format/row packing, small buffers, APB1.0 and handwritten SVH/C parity, scalar reference, independent stream BFM and focused tests. Preserve Y-only grayscale, RAW contract, resource limits and all earlier phase IDs.
 Do not implement DVP source repairs, Tiny routing/DMA/RCU integration, the complete SDK/display application or later phases. Do not add memory replay, RGB-to-gray arithmetic, interpolation, row/frame SRAM, DMA requests/masters, dependencies, profiles or quality-policy changes. Return SPEC_CONFLICT rather than weakening an unmet contract, and provide the scoped preflight/validation plan for explicit approval. Do not commit or push.
 ```
@@ -8,6 +8,17 @@ Tiny, SPI-SD, XPI, DMA and PIO evidence does not automatically cover this IP.

 ## Configuration and Identity

+- Current normative default: TINY/ICS55, `HAVE_PLL=YES`, SAFE24 boot under the
+  [2026-10-07 Tiny policy](tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07).
+  TINY-ICS55-P1 and its planned `configs/ci/ics55-tiny.mk` are pending;
+  the starting profile below remains executable IHP130 compatibility only.
+- Before final qualification, post-synthesis timing is observational and all
+  failures/NOT_RUN cases remain attributed. Functional/source/protocol and
+  synthesis/mapping/netlist-function gates remain mandatory. SPI-P5 joins
+  R2-P11/PIOLITE-P5/PPALITE-P5 after all functional phases on the identical
+  complete-product source/config/PDK/netlist. No intermediate timing closure
+  is required to proceed; final timing closure remains mandatory.
+
 - Starting profile: `configs/ci/ihp130-tiny.mk`, TINY, IHP130, 24 MHz/no PLL,
  current four-channel DMA and no SPI.
 - Target: SPI0 at `0x1001D000`, IRQ25, RCU16; modes 0-3, 8/16-bit frames,
@@ -20,8 +31,8 @@ Tiny, SPI-SD, XPI, DMA and PIO evidence does not automatically cover this IP.
 - Artifacts belong below the existing timestamped configuration-hash build
  root. A dry-run, tied-off capability or skipped fixture is not evidence.
 - Mini tests validate shared-DMA/GPIO compatibility with SPI support disabled.
-  Full qualification must use the same SPI/PIO-inclusive source and netlist
-  as any shared R2-P11/PIOLITE-P5 campaign.
+  Final qualification must use the same SPI/PIO/PPALite-inclusive source and
+  netlist as the mandatory R2-P11/PIOLITE-P5/PPALITE-P5 campaign.

 ## Required Case Matrix

@@ -88,7 +99,8 @@ all four modes; the display profile uses GPIO30 D/C and validates its own mode.

 Record actual configured/readable SCK, frame time, CPU cycles, DMA stalls,
 FIFO high/low watermarks and qualified device limits. Run PCLK 24 first;
-PCLK 48/60 cases await executable R2 profiles and physical inputs. Ideal
+PCLK 48/60 functional cases await executable R2 profiles and appropriate
+functional device models; their physical timing is a final-campaign gate. Ideal
 12/24/30 MHz ceilings and pixel-only timing arithmetic are not measured FPS.
 Legacy LCD/LVGL behavior, PIO14/15 and unaffected Tiny/Mini users must remain
 separate compatibility checks, not silently moved to SPI.
@@ -24,9 +24,22 @@ GUI framework or replace the legacy XPI LCD transport.

 ## Target SoCs and Integration Scope

+The [2026-10-07 Tiny refreeze](tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07)
+supersedes the original platform and timing-gate scope: default TINY/ICS55,
+`HAVE_PLL=YES`, SAFE24 boot; IHP130 remains explicit compatibility. The planned
+`configs/ci/ics55-tiny.mk` awaits TINY-ICS55-P1, so the existing commands below
+remain IHP130-only executable references. All pre-final post-synthesis timing
+is observational; functional/protocol, synthesis/mapping and netlist-function
+requirements remain. SPI-P5 joins R2-P11, PIOLITE-P5 and PPALITE-P5 only after
+all functional stages, on the same complete-product netlist. Preserve all
+phase IDs/titles and original evidence; a title containing IHP130 does not
+limit the new default target. This adds no SPI implementation or dependency
+upgrade beyond the separately approved Tiny PLL acquisition.
+
 | Item | Frozen contract |
 | --- | --- |
 | Target / status | TINY future standard product; MINI/STD/PRO integration deferred |
+| Default target / planned profile | ICS55, `HAVE_PLL=YES`, SAFE24 boot; `configs/ci/ics55-tiny.mk` pending TINY-ICS55-P1 |
 | Starting profile / PDK | `configs/ci/ihp130-tiny.mk` / IHP130, existing 24 MHz/no-PLL baseline |
 | Product sources | `rtl/tiny/top`, `rtl/tiny/integration/soc_topology.json`, `clock_reset_domains.json`, `rtl/tiny/address_map/memory_map.json`, `rtl/tiny/pin_map/pin_map.json` |
 | Filelists | Existing `rtl/tiny/filelist` ownership, especially `ip.fl`, `inc.fl`, `top.fl` and `tb.fl` |
@@ -647,7 +660,8 @@ explicit gaps, not substituted products or passing tests.

 ## Synthesis, Timing, and Physical Evidence

-Record source SHA, lock/config digests, TINY/IHP130 variant, PCLK/SYS/MEM,
+Record source SHA, lock/config digests, selected TINY/ICS55 (default) or
+TINY/IHP130 compatibility variant, PCLK/SYS/MEM,
 serial divider/mode/direction, Pad/board/slave loads and payloads for every
 measurement. Require block/full synthesis, register/FIFO mapping, area/cells,
 reset fanout/release, netlist simulation, CDC/RDC, PVT/MMMC and extracted STA.
@@ -656,10 +670,11 @@ external CS bias, QFN64 routing and power. Review DFT/storage-test coverage;
 no inferred-FIFO MBIST/ECC or production silicon status is implied.

 PCLK 24 is the executable starting frequency, not existing SPI timing evidence;
-48/60 require the corresponding R2 platform and physical inputs. Keep CPU/main
+48/60 functional tests require the corresponding R2 platform and device models,
+while physical inputs and timing closure belong to the final campaign. Keep CPU/main
 SRAM same-frequency qualification and existing XPI MEM constraints intact.
-SPI-P5 may share a campaign with TINY-R2-P11 and PIOLITE-P5 only when the same
-complete source/netlist/configuration satisfies all contracts. Missing Pad,
+SPI-P5 must join the final campaign with TINY-R2-P11, PIOLITE-P5 and PPALITE-P5
+only when the same complete source/netlist/configuration satisfies all contracts. Missing Pad,
 SRAM, clock, vendor or board evidence remains blocking for the affected claim.
 Do not alter observe-mode metrics or warning baselines through this freeze.

@@ -675,14 +690,14 @@ Stable IDs/titles below do not rename, reuse or advance R2/PIO phases.
 | SPI-P2 - DMA V2.2 Paced FIFO Integration | P1 and V2.1 cancellation/compatibility obligations, implemented here if not already delivered;5-bit encoding, port/source-qualified credit interfaces, exact packing/counts, jobs/drain and old-Mini regression. Retain single-beat MMIO policy; no PIO peripheral completion prerequisite or hidden burst optimization. |
 | SPI-P3 - Tiny GPIO RCU and SDK Integration | P2 plus applicable TINY-R2-P6/P7; topology/address/IRQ/RCU/filelists, four Gen1 ALT additions, latched source qualifier through fabric/CDC, GPIO readiness/ownership, bounded HAL. Firmware/simulations and unaffected Mini/PIO compatibility; no layout/source swap of legacy LCD. |
 | SPI-P4 - Display and Snapshot Application Qualification | P3; board display adapter, independent panel/data oracle and three stages of display patterns, PSRAM-source display and sequential camera/verify/display/SD. Camera/PSRAM cases require R2-P8/P9. Both simulators, host boundaries, error recovery and current-source regression/measurements pass. |
-| SPI-P5 - IHP130 Timing and Physical Qualification | P4 and applicable R2 system/PIO-inclusive product prerequisites; complete-netlist synthesis/netlist/STA/CDC/RDC/physical/Pad campaign. Publish only measured qualified operating points with residual gaps, optionally joint R2-P11/PIOLITE-P5. |
+| SPI-P5 - IHP130 Timing and Physical Qualification | Historical title; default ICS55. P4 and all product functional prerequisites; mandatory final campaign with R2-P11/PIOLITE-P5/PPALITE-P5 on the same complete netlist. Close synthesis/netlist/STA/CDC/RDC/physical/Pad gates; publish only qualified operating points. |

 ### Next-phase preflight handoff

 ```text
 Use $retrosoc-feature-implementation. Stage: preflight. Feature slug: spi. Target SoCs: TINY.
 Phase: SPI-P1 - SPI Core and Register Implementation.
-Read docs/ip/spi.md and docs/ip/spi-verification.md. The executable starting profile is configs/ci/ihp130-tiny.mk, PDK IHP130, 24 MHz/no PLL; it has no SPI integration yet.
+Read docs/ip/spi.md and docs/ip/spi-verification.md. Default target: ICS55/HAVE_PLL=YES with SAFE24 boot and planned configs/ci/ics55-tiny.mk; require accepted TINY-ICS55-P1 before integrated default-platform work. Current executable reference: configs/ci/ihp130-tiny.mk, IHP130, 24 MHz/no PLL, no SPI. Apply the 2026-10-07 observational pre-final timing policy and mandatory complete-product final campaign; do not invent an executable profile or relabel historical results.
 Plan only the frozen standalone master/APB1.0 core, packing/phase/lifecycle and source-qualified interface contracts, handwritten SVH/C parity, reference behavior, independent pin BFM and focused tests. Preserve all modes/8-16-bit packing, FIFO sizes, exact quotas, CS/D-C boundaries and bounded close/recovery semantics.
 Do not implement DMA V2.2, Tiny routing/RCU/fabric integration, the SDK/display application, new profiles or later phases. Do not change the frozen ABI, increase storage/pads, alter the legacy XPI LCD path, upgrade dependencies, change quality policy, commit or push. Return SPEC_CONFLICT rather than weakening an unmet contract, and provide the scoped preflight and validation plan for explicit approval before implementation.
 ```
@@ -1,5 +1,38 @@
 # Tiny MCU Verification Record

+## ICS55 default and final timing policy refreeze (2026-10-07)
+
+The [2026-10-07 normative policy](tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07)
+selects TINY/ICS55 with `HAVE_PLL=YES` and SAFE24 startup as the default target.
+`configs/ci/ics55-tiny.mk` and TINY-ICS55-P1 platform implementation are pending;
+`configs/ci/ihp130-tiny.mk` remains the current executable compatibility baseline.
+The existing 614fa623 commit adds shared ICS55 SRAM inputs, not Tiny enablement.
+
+All pre-final post-synthesis timing results are observations rather than phase
+completion gates. Keep applicable analysis attempts, macro mapping, netlist
+function, reset/protocol evidence and explicit FAIL/NOT_RUN attribution.
+Functional tests, accepted-work barriers, real-time deadlines and strict Tiny
+command/TEST_STATUS/SIM_TEST_PASS/forbidden-error checks remain mandatory.
+No warning baseline, metric policy or RTL maturity state is promoted.
+
+The sole final timing campaign combines TINY-R2-P11, SPI-P5, PIOLITE-P5 and
+PPALITE-P5 after Tiny foundation, SPI, PIO-lite and PPALite functional work.
+Their checklists require the same complete-product source/config/PDK/netlist;
+none is an intermediate physical dependency of another feature's functionality.
+Phase titles containing IHP130 remain historical identifiers; ICS55 is the new
+default and IHP130 compatibility results must remain separately attributed.
+
+PLL dependency: `pdk_ics55_pll`, revision
+`6ebb1a8f7f4ccbccdb7f587664fdfe63cd39e61b`, upstream `PLL_V02p1`.
+Its managed checkout is `.cache/retrosoc/sources/ics55_ecos_pll`.
+Cell/pin-only Liberty, absence of a LOCK output and unresolved upstream license
+remain explicit integration/release gaps. Acquisition is not hardware evidence.
+Refreeze validation and downloaded-view hashes are recorded separately below.
+
+The previous freeze and all executed R2-P0/P1/P2 and legacy records below retain
+their original dates, profiles, source identities, measurements and verdicts.
+They do not qualify ICS55 or satisfy the new platform-enablement phase.
+
 This record accompanies the [Tiny Gen1 contract](tiny-soc.md). The active R2
 verification plan below covers Target SoCs: `TINY`, feature `tiny-soc`, and
 the approved performance refreeze. `R2` is a roadmap revision, not a new IP
@@ -187,12 +220,16 @@ not a prerequisite to the architectural improvements in R2-P3 through R2-P5.

 ### R2 clock, reset and macro evidence

+For new work apply the default ICS55 binding and timing policy above. The
+following matrix retains frequency and functional obligations for both
+explicitly selected PDKs; historical measurements remain IHP130-only.
 The main 128 KiB SRAM includes its actual physical macro clock pins. It MUST
 use the same SYS source and active frequency as the CPU, with no hidden
 main-SRAM divider, CPU/main-SRAM CDC or half-rate fallback. The old P6/P10
 assignment of main SRAM to MEM is historical and is superseded for R2.
 Four logical 32 KiB banks do not mean four physical macros: verify the real
-IHP130 mapping and preserve the complete 128 KiB capacity. Crypto's six
+selected-PDK mapping (32 OpenECOS 1024x32 macros for ICS55) and preserve the
+complete 128 KiB capacity. Crypto's six
 private banks remain additional storage in PCLK and retain their own lifecycle.

 | Target profile | CPU and actual main SRAM / SYS | XPI / MEM | Shared peripherals and Crypto / PCLK |
@@ -272,8 +309,8 @@ cycle-level performance distinct from physical frequency qualification.
 | --- | --- | --- |
 | Functional | Actual Icarus and Verilator executions, strict terminal markers and result files, focused protocol/reset/error tests, and applicable formal/host tests separately identified | Does not establish performance or qualified clock rate |
 | Performance | Reproducible workload/compiler/placement A/B, cycle and instruction counts, service latency, throughput, contention and worst observed backpressure with stated workload bounds | A simulated clock assumption is not physical frequency evidence; observed maxima alone are not a universal bound |
-| Synthesis and netlist | Current IHP130 mapping of every main-SRAM/Crypto bank, area/cells, reset fanout, critical paths, netlist boot and applicable full-function checks | Library area is not die area; compact netlist boot does not replace full firmware or routed timing |
-| Physical | Actual source/profile/tool/PDK/corner/SDC identity; macro checks, CTS and reset distribution, extracted setup/hold and recovery/removal, CDC/RDC, IO/package/power and device timing | Behavioral PLL and pre-layout STA do not qualify an operating point or constitute foundry signoff |
+| Synthesis and netlist | Current selected-PDK mapping of every main-SRAM/Crypto bank, area/cells, reset fanout, critical paths, netlist boot and applicable full-function checks | Pre-final timing is observational; library area is not die area and compact netlist boot does not replace full firmware or routed timing |
+| Physical | Final combined complete-product campaign: source/profile/tool/PDK/corner/SDC identity; macro checks, CTS/reset distribution, extracted setup/hold/recovery/removal, CDC/RDC, IO/package/power and device timing | Mandatory final closure; behavioral PLL and pre-layout STA do not qualify an operating point or constitute foundry signoff |

 Each result must preserve commands, full logs, source revision, configuration
 digest, build variant, dependency/tool identity, library corners, simulator
@@ -297,6 +334,45 @@ mode; synthesis, simulation and timing failures remain recorded failures.
 No R2 test, benchmark or PPA result is claimed by this verification-plan edit.
 Actual documentation-only validation is recorded separately after execution.

+## 2026-10-07 refreeze execution record
+
+Scope: specification/ledger/guide changes and locked PLL acquisition only.
+The starting source was `614fa6237b6be5a14f51b39d1012a3ca79e1ad52`; the existing
+ECC work was subsequently committed as `14a253a49aa477e82f71bdbeb752280fff99b535`
+without changing the protected working-file contents. No Tiny profile, RTL,
+firmware, SDC, warning baseline or metric policy was changed by this refreeze.
+
+Validation artifacts are under
+[`build/ihp130-tiny-2026-10-07-18-10-414a31ff29aa/meta/tiny-refreeze-ics55-pll/`](../../build/ihp130-tiny-2026-10-07-18-10-414a31ff29aa/meta/tiny-refreeze-ics55-pll/).
+The existing IHP130 profile supplies the artifact namespace only; these are
+dependency/document/tooling checks, not new IHP130 or ICS55 hardware evidence.
+The proposed ICS55 Tiny profile remains absent.
+
+| Check | Result / artifact |
+| --- | --- |
+| Dependency lock | PASS; `lock.json`, 31 sources and 22 archives; only the approved PLL source was added to the existing working lock |
+| PLL restore and repetition | PASS; `setup.json`, `setup-repeat.json`; both logs record full SHA and all seven view hashes; checkout clean |
+| Focused dependency tests | PASS; `focused.json`, 19 tests including missing/wrong views, wrong revision, dirty checkout, idempotence and component isolation |
+| Ruff | PASS; `ruff.json` |
+| Full Pytest | PASS; `pytest.json`, 1541 passed / 1 skipped in 3593.34 s; the optional PDF retrieval test lacks `pypdf`, not a Tiny hardware gate |
+| Existing regression definitions | PASS; `tiny-pr-dry.json`, `tiny-nightly-dry.json`, `mini-ics55-pr-dry.json`; dry-runs only |
+| Documentation/source audit | PASS; `audit-delivery.json`; unchanged original phase titles, package/pinmux/RCU tables, historical R2/legacy evidence and unrelated ECC contents; added local links and PLL interface checked |
+
+The first clone failed with an HTTP/2 transport error before checkout. The
+same SHA was fetched with a command-local HTTP/1.1 override, then both ordinary
+helper runs passed without a version change. An initial test fixture inherited
+host Git signing; the fixture now disables signing/hooks for its own temporary
+commits only. No repository commit or global Git setting was made by this task.
+
+`evidence.json` indexes the successful gates and final source/input snapshot.
+The downloaded behavioral/blackbox views agree on 15 ports; min/typ/max Liberty
+contains no timing arcs. No LOCK output, characterized PLL timing or resolved
+upstream license was discovered. These remain pending integration/release gaps.
+SoC firmware/regression executions, full-SoC synthesis/netlist/STA, physical
+flows and generated publications are NOT_RUN by this documentation/dependency
+scope. Full Pytest's existing isolated fixtures are not product qualification.
+TINY-ICS55-P1 remains pending explicit preflight/implementation approval.
+
 ## R2-P0 documentation checks (2026-10-04)

 The working-tree documentation checks passed:
@@ -2,6 +2,14 @@

 ## Purpose and research boundary

+The 2026-10-07 refreeze selects **ICS55 as the default target PDK with
+`HAVE_PLL=YES`** and moves blocking post-synthesis timing acceptance to the
+complete-product final qualification campaign. The
+[platform and timing policy](#ics55-default-platform-and-final-timing-gate-2026-10-07)
+below supersedes earlier target-PDK and intermediate timing-gate wording.
+It does not relabel historical IHP130 results or make the planned ICS55 profile
+executable. This refreeze includes locked PLL acquisition, not RTL integration.
+
 The R2 portion of this contract freezes the performance-only design approved
 on 2026-10-04 for Target SoCs: `TINY`, feature slug `tiny-soc`. It preserves the QFN64
 package and pad allocation approved on 2026-09-26, the shared peripherals
@@ -55,8 +63,9 @@ contract and must not be read as the new Gen1 integration or clock qualification

 Product RTL, address/pin/topology inputs and filelists remain under `rtl/tiny`;
 the SDK and application composition retain their existing `crt/` and `app/`
-ownership. The active R2 execution order is `TINY-R2-P0` through `TINY-R2-P11`,
-with prerequisites pointing only to earlier R2 phases. Legacy `TINY-P0`
+ownership. The R2 phase identifiers remain `TINY-R2-P0` through `TINY-R2-P11`;
+the current product execution order is defined by the 2026-10-07 policy below.
+Legacy `TINY-P0`
 through `TINY-P12` keep their original headings and evidence in the archive;
 their former non-monotonic schedule is not the current execution plan.
 The current profile still selects four DMA channels and forbids PLL/non-24-MHz
@@ -75,6 +84,120 @@ processor and its route/source guards. PPALITE-P3 depends on applicable R2-P6/P7
 camera/memory acceptance uses R2-P8/P9, and preview uses the relevant SPI stages.
 Earlier R2, PIO or SPI results cannot qualify newly added PPALite logic.

+## ICS55 default platform and final timing gate (2026-10-07)
+
+This approved refreeze applies to Tiny and its SPI, PIO-lite and PPALite
+integration contracts. It adds ICS55 platform enablement to the former
+performance-only scope; unrelated SoCs and PDK rollouts remain excluded.
+
+- TINY-052: the default **target** is TINY/ICS55, `HAVE_PLL=YES`, 128 KiB main
+  SRAM and SAFE24 boot. The planned committed entrypoint is
+  `configs/ci/ics55-tiny.mk`; it does not exist yet. The current executable
+  entrypoint remains `configs/ci/ihp130-tiny.mk`, IHP130, 24 MHz/no PLL.
+  IHP130 remains an explicit compatibility option, not the future default.
+  Mini profiles and defaults are unchanged.
+- TINY-053: before final complete-product qualification, post-synthesis timing
+  closure is **observational, not a phase-completion gate**. Negative WNS/TNS,
+  setup/hold, recovery/removal, minimum-period/pulse-width and electrical
+  constraint violations do not alone block functional implementation phases.
+  Retain applicable synthesis, mapping, netlist-function and protocol checks,
+  STA attempts, exact inputs, reports and failure attribution. Missing timing
+  views remain `NOT_RUN`/unsupported evidence; script errors, unconstrained
+  paths and failed timing must never be relabeled as passing analysis.
+- TINY-054: timing closure remains mandatory in the final complete-product
+  campaign on the same SPI/PIO-lite/PPALite-inclusive source, configuration,
+  PDK and netlist. Qualify each advertised point with characterized libraries,
+  CTS/reset distribution, extracted PVT/MMMC, CDC/RDC, IO/board/package and
+  power evidence. An unsupported point is a delivery gap, not a waiver or
+  completion of the full target. Earlier functional high-rate simulations
+  are permitted but are not physical operating-frequency claims.
+- TINY-055: acquire the single-output integration of the locked OpenECOS
+  `PLL_TOP` described below. `HAVE_PLL=YES` means macro presence, not selection
+  at reset, qualified lock or qualified timing. Missing macro views must not
+  silently synthesize a bypass. The default PLL-present design boots on REF24
+  and enables fast operation only through the accepted lifecycle protocol.
+
+The execution order is ICS55 platform enablement, remaining Tiny foundation
+through R2-P10, SPI-P1..P4, PIOLITE-P1..P4, PPALITE-P1..P4, then one final
+campaign combining **TINY-R2-P11, SPI-P5, PIOLITE-P5 and PPALITE-P5**. Their
+individual checklists remain mandatory; none is an early physical prerequisite
+for the other features' functional phases. Existing phase IDs and titles,
+including titles containing `IHP130`, are preserved as historical identifiers;
+their active target is now default ICS55 and explicitly selected IHP130
+compatibility. Evidence is never transferable between PDKs. No earlier phase
+is automatically reopened, passed or advanced by this policy.
+
+QFN64, every IO/power terminal, the main-SRAM aperture and 128 KiB capacity,
+Crypto's six private banks, boot/debug and register ABI remain unchanged.
+The default main-SRAM binding is 32 `ics55_ecos_sram_1024x32_m8` macros from
+the existing locked SRAM releases; IHP130 retains its 32 corresponding macros.
+CPU and actual main SRAM share SYS at the same active frequency. There is no
+half-rate SRAM fallback or minimum-period waiver via bus wait states.
+Higher PCLK/SYS functional profiles require implemented clock/platform support,
+not an intermediate physical signoff. Hardware frequency claims still require
+the final campaign. This policy does not relax functional correctness,
+reset/CDC protocols, real-time service budgets, source qualification or Tiny's
+strict command/TEST_STATUS/SIM_TEST_PASS/forbidden-error verdict rules.
+Warning baselines, global metric policy and RTL maturity labels are unchanged.
+
+### Locked ICS55 PLL integration contract
+
+Use [OpenECOS ICS55 PLL, PLL_V02p1](https://github.com/openecos-projects/ics55_ecos_pll/tree/6ebb1a8f7f4ccbccdb7f587664fdfe63cd39e61b),
+locked as `sources.pdk_ics55_pll` at full revision
+`6ebb1a8f7f4ccbccdb7f587664fdfe63cd39e61b`. Its managed checkout is
+`.cache/retrosoc/sources/ics55_ecos_pll`, separate from replaceable PDK Liberty
+caches. The upstream license is to be determined; record `NOASSERTION` and
+retain licensing as a release gap rather than inferring an open-source license.
+
+Use the behavioral Verilog only for functional simulation and the blackbox
+for physical elaboration, with LEF and the min/typ/max Liberty views retained.
+The supplied Liberty has cell/pin information **without timing arcs**. It is
+not characterized PLL timing or signoff evidence; the final campaign requires
+qualified replacement/additional characterization and generated-clock inputs.
+Do not remove existing physical-flow guards merely because the views exist.
+
+For a 24 MHz reference, preserve `tc_pll` selectors 5 and 7:
+
+| Profile | N | SELECT | OD encoding / divisor | VCO | CKOUT1 |
+| --- | ---: | ---: | --- | ---: | ---: |
+| PLL192 / selector 5 | 32 | 0 | 2 / 4 | 768 MHz | 192 MHz |
+| PLL240 / selector 7 | 40 | 0 | 2 / 4 | 960 MHz | 240 MHz |
+
+Both use `BP=0`; only CKOUT1 supplies the functional PLL clock. CKOUT2 and
+CKTST add no clock domain or package pin. Keep SAFE24 startup, the existing
+no-PLL external-input option and the SYS/MEM/PCLK ratios below. These are
+configuration targets, not measured frequencies or physical qualification.
+
+The macro has no LOCK output. The integration must qualify clock activity,
+rate/stability and loss through observable signals and bounded reference-domain
+control; it must not access the behavioral model's internal `pll_ready` or
+equate a fixed delay with analog lock. Upstream's typical startup is not a
+PVT bound. The existing ICS55 adapter's `N=2` and four-reference-edge lock
+counter are incompatible with this integration and require later repair.
+Connect all six supply/ground pins explicitly, including in simulation;
+physical rail/ground mapping requires the unchanged package power plan.
+Preserve the existing XIN-loss/external-reset recovery boundary without adding
+an independent oscillator. PLL functional modeling supplies neither analog
+lock/jitter proof nor final frequency qualification.
+
+### TINY-ICS55-P1 - Default PDK and PLL Platform Enablement
+
+This is a new, pending implementation prerequisite before remaining R2 work,
+not a renaming of R2-P1/P2. Introduce the default ICS55 Tiny profile and explicit
+PDK selection, reuse the locked SRAM and PLL inputs, adapt filelists, technology
+bindings and observation endpoints, and establish SAFE24 PLL-present boot,
+memory/DMA/interrupt/debug regression plus IHP130/shared-Mini compatibility.
+Retain 128 KiB, all package assignments and the original comparison binaries.
+Record the PLL backend's standalone 192/240 functional capability; full Tiny
+RCU transitions, gating, fault recovery and rate reporting remain R2-P7.
+Do not advertise unimplemented RCU capability or force an early high-rate boot.
+
+Acceptance requires an executable source-bound platform, actual macro binding,
+both simulators and strict Tiny verdicts, dependency/model identity, relevant
+synthesis/netlist checks and observational timing with explicit gaps. Physical
+timing closure is deferred to the combined final campaign. This refreeze
+implements only documentation and dependency acquisition, not this phase.
+
 ### Commercial references and reuse boundary

 The following primary references were reviewed during the 2026-09-30 research;
@@ -236,8 +359,11 @@ no commercial implementation or qualification is reused.
  validated performance build and bank-aware placement policy. Hardware ISA,
  compiler flags, firmware size and linker budgets MUST be independently
  checked; upstream benchmark scores are not Tiny performance evidence.
- TINY-035: main-SRAM, CPU and fabric timing MUST be qualified jointly at SYS.
-  A failing rate is lowered or disabled for CPU and main SRAM together;
+- TINY-035: final physical release MUST qualify main-SRAM, CPU and fabric
+  timing jointly at SYS. Before the final campaign, timing is observational
+  under TINY-053 and does not block functional testing at modeled target rates.
+  For physical release, a failing rate is lowered by reviewed profile change
+  or disabled for CPU and main SRAM together;
  MUST NOT restore a half-rate main-SRAM fallback. Extra response wait states
  do not repair a macro's minimum-clock-period violation.
 - TINY-036: ACCEPTANCE separates functional, workload-performance, synthesis/
@@ -632,7 +758,7 @@ selects the correct response. The instruction path supports SRAM and the
 NOR boot/executable NSS0 apertures; a fetch from a peripheral/control region
 must fail before any read side effect. Absent regions retain decode errors.

-| Logical arbitration group | Address range | IHP130 storage | Example performance layout |
+| Logical arbitration group | Address range | ICS55 / IHP130 storage | Example performance layout |
 | --- | --- | --- | --- |
 | B0 | `0x30000000..0x30007FFF` | Eight existing 4 KiB single-port macros | Hot code and interrupt/exception entry |
 | B1 | `0x30008000..0x3000FFFF` | Eight existing 4 KiB single-port macros | Remaining code and read-only tables |
@@ -698,7 +824,8 @@ SRAM payload contents are not cleared by reset.

 Reuse the shared SRAM register definitions and technology wrappers. Tiny
 owns its routing/arbitration integration; shared changes must preserve default
-Mini behavior and pass affected consumer regressions. For Tiny/IHP130,
+Mini behavior and pass affected consumer regressions. For default Tiny/ICS55
+and explicit Tiny/IHP130 compatibility,
 `BANK_COUNT=32` and `BANK_BYTES=4096` continue describing physical storage,
 not four 32 KiB arbitration groups. Group placement is published in build
 and linker information without repurposing those fields or adding a new
@@ -1207,7 +1334,7 @@ with double-buffer display/save is not enabled by the new SPI interface.
 `HAVE_PLL=YES` emits the existing `HAVE_PLL` condition and instantiates the
 single-output `tc_pll` boundary. Do not add a second Tiny-specific PLL-presence
 macro or assume an extra 96/48 MHz PLL output. `HAVE_PLL=NO` removes the PLL
-and reports its profiles unsupported. A physical PLL configuration requires
+and reports its profiles unsupported. A physical-release PLL configuration requires
 a qualified backend; a behavioral model is not an analog implementation.

 Without PLL, the supported external XIN inputs are 24, 48 and 96 MHz. Fixed
@@ -1271,13 +1398,15 @@ ratio bridge or CPU-to-main-SRAM CDC is permitted. This explicitly supersedes
 the P6/P10 main-SRAM-in-MEM assignment, not the XPI MEM ceiling. The common
 clock does not imply zero-cycle arbitration or one-cycle CPU memory service.

-Qualify CPU and main SRAM jointly at every supported rate. In particular,
+At final qualification, qualify CPU and main SRAM jointly at every supported rate. In particular,
 192 MHz requires approximately a 5.208 ns period and 240 MHz a 4.167 ns period at the
 actual SRAM macro clocks. Check macro minimum period, pulse widths,
 setup/hold and clock-to-output together with bank decode, arbitration and
 return paths. Extra bus wait cycles alone cannot repair a macro internal
-minimum-period violation. If a candidate fails, disable that CPU/SRAM point
-or lower both together through an explicitly reviewed profile; never restore
+minimum-period violation. Before final qualification, retain a failing candidate
+as observational evidence without blocking functional phase progression or
+claiming physical support. For physical release, disable a failing CPU/SRAM
+point or lower both together through an explicitly reviewed profile; never restore
 CPU240/SRAM120 as a fallback. The target frequencies remain unqualified until
 the required physical evidence passes.

@@ -1810,7 +1939,11 @@ cannot close the additional PPALite product requirements.

 The active roadmap is `TINY-R2-P0` through `TINY-R2-P11`. R2 is a roadmap
 revision, not a new feature slug, register ABI, product series or PDK. All
-phases target TINY/IHP130 and preserve affected Mini consumers of shared code.
+phases now target TINY/ICS55 by default, retaining explicitly selected IHP130
+compatibility and affected Mini consumers of shared code. The 2026-10-07
+platform/timing policy inserts TINY-ICS55-P1 before remaining foundation work
+and moves R2-P11 into the final combined product campaign after all three
+extensions' functional phases. Historical phase titles remain unchanged.
 Unless a phase explicitly narrows its scope below, each phase depends on the
 preceding R2 phase; no active prerequisite points to a higher phase number.
 Legacy IDs below identify provenance only, not an additional execution order.
@@ -1834,7 +1967,8 @@ P0-P4 historical evidence does not establish complete qualification. P5/P6/P10
 were documentation milestones, not hardware passes. The pending work of legacy
 P7/P8/P11/P12 and outstanding P9 obligations move to this active plan without
 rewriting their original headings, dates or results. New implementation prompts,
-indexes and acceptance records must use the full R2 IDs. The archive below
+indexes and acceptance records must use the applicable full R2 or new
+TINY-ICS55-P1 ID. The archive below
 retains the old schedule for interpretation of older records only.

 ### TINY-R2-P0 - Performance Contract and Roadmap Freeze
@@ -1875,14 +2009,14 @@ Use the baseline commands and the R2 validation entrypoints below.
 Audit and improve local reset distribution and ordinary FIFO reset load only
 where behavior and stale-data isolation are proved. Preserve five-edge release,
 CPU-last boot, warm-flush barriers and the Crypto erasure exception. Check the
-actual IHP130 macro timing views, minimum period/pulse widths, setup/hold,
+actual selected-PDK macro timing views, minimum period/pulse widths, setup/hold,
 clock-to-output and representative CPU/bank/reset paths at candidate joint rates.

 Acceptance combines focused reset/protocol/equivalence checks, the affected
 firmware/simulators, and source-bound synthesis/STA feasibility records. Identify
 the safe-frequency branch and every unsupported or unverified higher rate.
-High-rate blockers do not prohibit continuing the safe-frequency branch, but
-do prohibit advertising that operating point. Early feasibility is not final
+Timing failures at any analyzed rate do not prohibit functional phase acceptance,
+but prohibit advertising that physical operating point. Early feasibility is not final
 routed/PVT signoff and does not authorize half-rate main SRAM.

 ### TINY-R2-P3 - Software and DMA Scheduling
@@ -2007,6 +2141,11 @@ the unchanged policy, and no predetermined speedup substitutes for evidence.

 ### TINY-R2-P11 - IHP130 Physical and Product Qualification

+The title is retained for historical traceability. Under the 2026-10-07
+refreeze this is the final default-ICS55 complete-product campaign, jointly
+closing SPI-P5, PIOLITE-P5 and PPALITE-P5 on the identical inclusive netlist.
+Explicit IHP130 compatibility qualification uses its own inputs and evidence.
+
 Complete final CTS/reset distribution, extracted timing, actual SRAM/PLL/input
 macro checks, PVT/MMMC, CDC/RDC, IO/board timing, power/activity and package
 binding for each supported point. CPU and main SRAM qualify together; XPI
@@ -2023,10 +2162,14 @@ claim complete Gen1 while named shared-IP or physical prerequisites remain open.
 The separately approved PIO-lite standard-product extension has its own
 `PIOLITE-P0` through `PIOLITE-P5` development order in [piolite.md](piolite.md).
 R2-P6/P7 supply platform prerequisites for `PIOLITE-P3`; they do not implement
-PIO-lite merely by reserving its identifiers. `PIOLITE-P5` and R2-P11 may
-share evidence only when it covers the same PIO-inclusive source revision,
-configuration, PDK/corners and all requirements from both contracts. An R2
-run without PIO-lite cannot close the extended standard-product release.
+PIO-lite merely by reserving its identifiers. `PIOLITE-P5`, SPI-P5, PPALITE-P5
+and R2-P11 now form the mandatory combined final campaign on the same
+complete-product source revision, configuration and PDK/corners, satisfying
+every component contract. An earlier partial-product run cannot close release.
+The default ICS55 Tiny full-chip adapter, package binding and characterized
+PLL timing remain implementation prerequisites of this final campaign. The
+existing Mini padless ECC flow and IHP130 Tiny physical runs do not supply
+those ICS55 complete-product results.

 ### R2 validation entrypoints

@@ -2045,12 +2188,15 @@ make CONFIG=configs/ci/ihp130-tiny.mk regress-pr
 make CONFIG=configs/ci/ihp130-tiny.mk regress-nightly
 ```

-R2-P2/P4/P5 require their affected synthesis/STA and focused protocol/reset
+R2-P2/P4/P5 retain their affected synthesis/STA attempts and focused protocol/reset
 tests; R2-P10/P11 require the relevant synthesis/netlist/physical flows in
 addition to these entrypoints. The validation matrix identifies each phase's
 evidence class. Record exact directed/formal commands when those cases are
 introduced; do not assume a nonexistent target, a skipped RTL test or another
-product's result satisfies Tiny acceptance.
+product's result satisfies Tiny acceptance. Before the combined final campaign,
+post-synthesis timing is observational under TINY-053. The commands above
+remain the existing IHP130 executable baseline; the proposed ICS55 Tiny profile
+and its commands must be introduced and verified by TINY-ICS55-P1.

 ## Archived P0-P12 development order and acceptance

@@ -2445,18 +2591,19 @@ concurrency and final physical product qualification are different claims.

 ## Implementation handoff

-The first implementation step after this R2-P0 freeze is the R2-P1 preflight
-below. Subsequent work advances through R2-P2 to R2-P11. The archived legacy
-IDs remain valid evidence references, not current implementation instructions.
-This freeze starts no hardware work and closes no historical physical gap.
+The next platform step after the 2026-10-07 refreeze is TINY-ICS55-P1 preflight.
+Historical R2-P1/P2 evidence remains IHP130-only. After platform enablement,
+resume the remaining Tiny foundation, then SPI, PIO-lite and PPALite functional
+phases, followed by the combined final qualification campaign. This handoff
+authorizes no implementation or automatic phase advancement.

 ```text
 Use $retrosoc-feature-implementation in preflight mode for feature tiny-soc.
 Target SoCs: TINY.
-Phase: TINY-R2-P1 - Reproducible Baseline, Constraints and Measurements.
+Phase: TINY-ICS55-P1 - Default PDK and PLL Platform Enablement.
 Specification: docs/ip/tiny-soc.md; evidence: docs/ip/tiny-soc-verification.md.
-Start from configs/ci/ihp130-tiny.mk, PDK IHP130, at the existing 24 MHz/no-PLL executable baseline. Map the reviewed source, configuration, locked tools, physical macro inputs, clock/reset constraints and historical evidence before proposing changes. Identify deterministic CPU/memory/DMA contention workloads, retained comparison binaries and the exact functional/performance/synthesis/physical evidence each can provide. Report missing inputs and failed or unrun gates explicitly; do not reuse historical timing values as current measurements.
-Preserve QFN64/IO pads, 128 KiB user SRAM, private Crypto storage, boot/debug behavior and shared-IP ownership. Carry the frozen R2 targets into the preflight: actual CPU/main-SRAM macros share SYS at 96/192/240 MHz targets, XPI remains divided in MEM, Crypto remains PCLK and CPU-only WFI gating leaves SRAM live. No half-rate main-SRAM fallback is allowed; each operating point needs joint macro/system qualification.
-R2-P1 establishes the baseline and measurement plan only. Do not implement R2-P2 or later reset, dual-port CPU, four-bank SRAM, concurrent fabric, compiler-profile, shared-IP, camera or clock changes in this phase. Keep the compatible executable profile and warning/metric policy unchanged unless a separately approved change is necessary. Do not add SPI, PIO-lite, Boot ROM, caches, atomics, SRAM capacity or PDK scope.
-Produce the single-phase preflight with file ownership, reproducibility inputs, workload/measurement definitions, validation commands, blockers and acceptance boundaries before implementation. Use R2 phase IDs for new work and preserve the archived legacy IDs/evidence mapping. Validate affected Mini consumers whenever shared code is subsequently changed; no 96/192/240 MHz or physical-release claim follows from this preflight.
+Current executable reference: configs/ci/ihp130-tiny.mk, IHP130, 24 MHz/no PLL. Planned default: configs/ci/ics55-tiny.mk, ICS55, HAVE_PLL=YES, SAFE24 boot; do not pretend this profile already exists. Map the current source/worktree, locked OpenECOS SRAM and pdk_ics55_pll inputs, models, technology bindings and tools. PLL pin: 6ebb1a8f7f4ccbccdb7f587664fdfe63cd39e61b. Its Liberty has no timing arcs and its interface has no LOCK output; retain those qualification gaps.
+Plan the smallest platform/profile/filelist/PLL-backend integration and source-bound functional baseline. Preserve QFN64 and IO/power assignments, 128 KiB CPU-rate main SRAM, private Crypto storage, boot/debug, original workload binaries and IHP130/shared-Mini compatibility. No half-rate SRAM fallback. Preserve selector 5/7 mappings for PLL192/240 and reject the old N=2/four-cycle lock assumption.
+Full Tiny RCU transitions and dynamic rate reporting remain R2-P7; do not implement later CPU/banking/fabric/DMA/peripheral phases. Preserve dependency versions, warning baselines and metrics policy. Retain required synthesis/mapping/netlist-functional checks and observational STA, with failures and missing inputs explicit. No intermediate post-synthesis timing closure gate; final timing and physical qualification occur only on the complete SPI/PIO-lite/PPALite-inclusive product.
+Return a single-phase preflight with exact proposed changes, ownership, validation commands, blockers and acceptance boundaries. Read-only preflight only: no edits, dependency restoration, builds, simulations or STA. Do not commit, push, create a PR or advance a phase. Stop for explicit implementation approval.
 ```
@@ -5,7 +5,9 @@
 This document defines the intended Tiny, Mini, Std, and Pro product ladder.
 Tiny and Mini have executable build profiles; Std and Pro remain roadmap
 targets. Committed product profiles and retained validation evidence define
-implemented support. Tiny first targets IHP130 as a wired MCU.
+implemented support. Tiny's 2026-10-07 specification selects ICS55/PLL as its
+default wired-MCU target; current executable Tiny remains IHP130/no PLL until
+TINY-ICS55-P1. IHP130 remains explicit compatibility, and Mini defaults are unchanged.

 Mini is the family anchor. It establishes the common product model: an open
 RISC-V SoC in which a small, always-available Hazard3 management core owns
@@ -40,6 +42,15 @@ verification requirements differ materially.

 ## Tiny: Low-Power MCU and Edge Connectivity

+The [2026-10-07 refreeze](ip/tiny-soc.md#ics55-default-platform-and-final-timing-gate-2026-10-07)
+requires ICS55 with `HAVE_PLL=YES`, SAFE24 startup and unchanged CPU-rate
+128 KiB SRAM. The planned `configs/ci/ics55-tiny.mk` is not executable yet.
+After platform enablement, the order is remaining Tiny foundation, SPI,
+PIO-lite, PPALite, then one complete-product final physical campaign. Earlier
+post-synthesis timing is observational; functionality and source-bound evidence
+remain required. R2-P11 and the extensions' P5 IDs/titles are retained and
+closed jointly on the same final design. This does not qualify a frequency.
+
 ### Position

 Tiny serves battery-powered sensors, actuators, metering, low-power industrial
@@ -57,7 +68,9 @@ UARTs, two I2C controllers and legacy pad routing. The QFN64 Gen1 target was
 established on 2026-09-26, extended with shared IP and clock/reset requirements
 on 2026-09-30, and with DVP/XPI frame buffers on 2026-10-01. The 2026-10-04
 [R2 performance contract](ip/tiny-soc.md) replaces the remaining execution
-order with sequential `TINY-R2-P0` through `TINY-R2-P11`; the original
+order with `TINY-R2-P0` through `TINY-R2-P11`; the 2026-10-07 refreeze adds
+ICS55 platform enablement and defers R2-P11 to the complete-product final
+campaign after SPI, PIO-lite and PPALite functionality. The original
 `TINY-P0` through `TINY-P12` IDs/titles remain in that contract's history.
 Existing generated datasheets describe the baseline, not completed R2
 implementation or qualification.
@@ -99,12 +112,12 @@ qualification from the unchanged executable baseline.
 | Memory model | No MMU, HP hart or external RAM boot dependency; optional initialized XPI NSS1 PSRAM for whole-frame data, bounded by actual device capacity |
 | Interconnect | Per-target concurrent AXI32 with three external owners: CPU non-SRAM I/D merge, central DMA and SDIO private DMA; independent local SRAM I/D paths, APB4 control and explicit domain bridges; no RIB/RIBP |
 | Software | Shared peripheral specifications, addresses and HAL source; product-specific RCU/SYSCTRL backend and routing/clock configuration; compatible RV32IM build plus separately validated performance compiler/linker configuration |
-| Clock/reset | CPU and main SRAM share SYS at 24/96/192/240 MHz targets; XPI MEM at 24/96/96/120 MHz; PCLK at 24/48/48/60 MHz; no main-SRAM CDC, fixed 1 MHz CLINT tick, no independent safety RC; all faster profiles require qualification |
+| Clock/reset | Default ICS55/HAVE_PLL=YES with SAFE24 boot; CPU and main SRAM share SYS at 24/96/192/240 MHz targets; XPI MEM at 24/96/96/120 MHz; PCLK at 24/48/48/60 MHz; no main-SRAM CDC, fixed 1 MHz CLINT tick, no independent safety RC; physical rate claims require final qualification |
 | Edge I/O | 32 user GPIO, one UART, one I2C, one full-duplex master/slave I2S target, alternate 8-bit DVP V2 camera profile, one 3.3 V 1-bit/4-bit SDIO host, two timers, eight central DMA channels, four PWM outputs, RTC, watchdog and XPI |
 | Shared services | RNG V2, CRC V2, WS2812 and Crypto V2 at Mini-compatible addresses; entropy and security claims require separate qualification |
 | Package | QFN64 plus separate EP: 48 signal and 16 power/ground terminals; preferred 9 x 9 mm, 0.5 mm pitch pending physical review |
 | Dedicated signals | Six boot XPI pins and five JTAG pins outside the 32 GPIO; XPI CS1-3 use GPIO29-31 |
-| Power | One 3.3 V digital IO rail; IHP130 Core planned at 1.2 V; clock analog supply and EP connection require macro/package confirmation |
+| Power | One 3.3 V digital IO rail; ICS55 default and IHP130 compatibility Core nominally 1.2 V; clock analog supply/ground and EP binding require macro/package confirmation without changing terminal assignments |

 The normative [Tiny Gen1 contract](ip/tiny-soc.md) defines the complete QFN64
 pinout, power/reset requirements and GPIO/ALT0/ALT1 table. Default SDIO,
@@ -35,6 +35,25 @@ Liberty views are materialized below `.cache/retrosoc/pdk/ics55/sram/`; the
 `tc_sram_1024x32` and `tc_sram_4096x32` connect the release byte-write macros
 directly. No local commercial ICS55 SRAM model is required.

+ICS55 setup also restores `sources.pdk_ics55_pll` (`PLL_V02p1`, full revision
+`6ebb1a8f7f4ccbccdb7f587664fdfe63cd39e61b`) to
+`.cache/retrosoc/sources/ics55_ecos_pll`. To acquire just the PLL without
+touching other PDK inputs, run:
+
+```sh
+python3 physical/pdk/setup.py --pdk ICS55 --component pll
+```
+
+The default `--component all` retains existing PDK setup and adds PLL
+acquisition for ICS55. Other PDK/component combinations with `pll` are rejected.
+The helper checks the README, behavioral/blackbox Verilog, LEF and three
+Liberty views and prints their hashes. No profile or RTL binding is changed.
+The views have no characterized timing arcs or LOCK output; licensing is
+undetermined. Functional modeling, actual lock/loss detection, supply binding
+and final timing characterization remain separate integration/release work.
+Tiny's new default ICS55/PLL specification still requires TINY-ICS55-P1;
+current executable Tiny configurations remain IHP130/no PLL.
+
 The IHP130 dependency is also the technology source for the independent
 `physical/librelane/{mini,tiny}/` core-hardening and full-chip pad-ring flows.
 The locked
@@ -1,6 +1,8 @@
 #!/usr/bin/env python3

 import argparse
+import json
+import re
 import subprocess
 import sys
 from pathlib import Path
@@ -10,14 +12,55 @@ ROOT = Path(__file__).resolve().parents[2]
 PDK_DIR = Path(__file__).resolve().parent
 sys.path.insert(0, str(ROOT))
 from scripts.dependency_lock import archive, source  # noqa: E402
-from scripts.setup_helpers import download_file, ensure_git_repo  # noqa: E402
+from scripts.setup_helpers import download_file, ensure_git_repo, sha256  # noqa: E402
+
+
+PLL_VIEWS = (
+    "README.md", "verilog/PLL_TOP.behavioral.v", "verilog/PLL_TOP.blackbox.v",
+    "lef/PLL_TOP.lef", "lib/PLL_TOP_min.lib", "lib/PLL_TOP_typ.lib", "lib/PLL_TOP_max.lib",
+)
+
+
+def setup_ics55_pll(*, update: bool = False) -> dict:
+    """Restore the locked integration views without selecting them in any RTL flow."""
+    dependency = source("pdk_ics55_pll")
+    destination = ROOT / dependency["destination"]
+    ensure_git_repo(dependency["url"], destination, dependency["revision"], update=update)
+    hashes = {}
+    for name in PLL_VIEWS:
+        path = destination / name
+        if not path.is_file() or path.stat().st_size == 0:
+            raise ValueError(f"ICS55 PLL view is missing or empty: {path}")
+        content = path.read_text(encoding="utf-8")
+        pattern = None
+        if path.suffix == ".v":
+            pattern = r"\bmodule\s+PLL_TOP\s*\("
+        elif path.suffix == ".lib":
+            pattern = r'\bcell\s*\(\s*"?PLL_TOP"?\s*\)'
+        elif path.suffix == ".lef":
+            pattern = r"\bMACRO\s+PLL_TOP\b"
+        if pattern is not None and re.search(pattern, content) is None:
+            raise ValueError(f"ICS55 PLL view does not define PLL_TOP: {path}")
+        hashes[name] = sha256(path)
+    record = {"source": "pdk_ics55_pll", "revision": dependency["revision"],
+              "destination": str(destination), "sha256": hashes,
+              "qualification": "integration views only; no characterized PLL timing arcs"}
+    print(json.dumps(record, sort_keys=True))
+    return record


 def main() -> int:
    parser = argparse.ArgumentParser(description="Install pinned open PDKs")
    parser.add_argument("--update", action="store_true")
    parser.add_argument("--pdk", choices=("IHP130", "ICS55", "GF180", "SKY130"), action="append")
+    parser.add_argument("--component", choices=("all", "pll"), default="all",
+                        help="pll restores only the ICS55 PLL integration views")
    args = parser.parse_args()
+    if args.component == "pll":
+        if args.pdk != ["ICS55"]:
+            parser.error("--component pll requires exactly --pdk ICS55")
+        setup_ics55_pll(update=args.update)
+        return 0
    selected = args.pdk or ("IHP130", "ICS55", "GF180", "SKY130")
    names = {
        "IHP130": "pdk_ihp130",
@@ -205,6 +248,7 @@ def main() -> int:
                ),
                check=True,
            )
+            setup_ics55_pll(update=args.update)
    return 0


@@ -1,7 +1,10 @@
 # Tiny MCU Integration

 Tiny is the independent single-Hazard3 wired MCU product. Its frozen target
-contract is [Tiny Gen1 QFN64 R2](../../docs/ip/tiny-soc.md). Use
+contract is [Tiny Gen1 QFN64 R2](../../docs/ip/tiny-soc.md). The 2026-10-07
+specification default is ICS55, `HAVE_PLL=YES`, SAFE24 boot; TINY-ICS55-P1
+platform integration and `configs/ci/ics55-tiny.mk` are pending. IHP130 remains
+explicit compatibility. For the current executable baseline, use
 `make CONFIG=configs/ci/ihp130-tiny.mk setup` followed by
 `make CONFIG=configs/ci/ihp130-tiny.mk firmware sim`.

@@ -29,12 +32,16 @@ into the external path, preserving three external owners with central DMA and
 SDIO. Per-target arbitration replaces the global transaction lock. XPI stays
 in MEM at 24/96/96/120 MHz and Crypto's six private banks remain PCLK.

-The active execution order is sequential `TINY-R2-P0` through `TINY-R2-P11`
-in the linked contract. Software/DMA scheduling is `TINY-R2-P3`, local CPU/SRAM
+The active order inserts TINY-ICS55-P1 before remaining R2 foundation through
+P10, followed by SPI, PIO-lite and PPALite functional stages, then a combined
+R2-P11/SPI-P5/PIOLITE-P5/PPALITE-P5 complete-product campaign. Existing IDs and
+titles remain intact; pre-final post-synthesis timing is observational while
+final timing closure is mandatory. Software/DMA scheduling is `TINY-R2-P3`, local CPU/SRAM
 `TINY-R2-P4`, concurrent fabric `TINY-R2-P5`, shared-IP/eight-channel integration
 `TINY-R2-P6`, RCU `TINY-R2-P7`, XPI PSRAM `TINY-R2-P8`, camera capture
-`TINY-R2-P9`, system qualification `TINY-R2-P10` and IHP130 physical
-qualification `TINY-R2-P11`. Legacy `TINY-P0` through `TINY-P12` remain in
+`TINY-R2-P9`, system qualification `TINY-R2-P10` and complete-product physical
+qualification `TINY-R2-P11` (historical IHP130 title; now default ICS55).
+Legacy `TINY-P0` through `TINY-P12` remain in
 the contract history. The committed RTL/profile still implements the initial
 24 MHz/no-PLL/four-channel design; no faster CPU/SRAM or PLL timing support
 follows from this freeze or the `HAVE_PLL` selector alone.
@@ -0,0 +1,141 @@
+"""Locked PLL acquisition is independent of product integration and other PDK setup."""
+
+from __future__ import annotations
+
+import hashlib
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from physical.pdk import setup
+from scripts import setup_helpers
+from scripts.dependency_lock import source
+
+
+def git(directory: Path, *args: str) -> str:
+    return subprocess.check_output(["git", "-C", str(directory), *args], text=True).strip()
+
+
+def commit(directory: Path) -> str:
+    git(directory, "add", ".")
+    git(directory, "-c", "commit.gpgsign=false", "-c", "core.hooksPath=/dev/null",
+        "-c", "user.name=PLL fixture", "-c", "user.email=fixture@example.invalid",
+        "commit", "-qm", "PLL fixture")
+    return git(directory, "rev-parse", "HEAD")
+
+
+@pytest.fixture
+def locked_pll(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> tuple[Path, dict]:
+    upstream = tmp_path / "upstream"
+    upstream.mkdir()
+    git(upstream, "init", "-q")
+    for name in setup.PLL_VIEWS:
+        path = upstream / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        if path.suffix == ".v":
+            content = "module PLL_TOP (input REFCLK, output CKOUT1); endmodule\n"
+        elif path.suffix == ".lef":
+            content = "MACRO PLL_TOP\nEND PLL_TOP\n"
+        elif path.suffix == ".lib":
+            content = "library (fixture) { cell (PLL_TOP) {} }\n"
+        else:
+            content = "PLL integration fixture; no timing qualification.\n"
+        path.write_text(content)
+    dependency = {"url": str(upstream), "revision": commit(upstream),
+                  "destination": "cache/pll"}
+    monkeypatch.setattr(setup, "ROOT", tmp_path)
+
+    def selected(name: str) -> dict:
+        assert name == "pdk_ics55_pll", "PLL-only setup touched another dependency"
+        return dependency
+
+    monkeypatch.setattr(setup, "source", selected)
+    return upstream, dependency
+
+
+def test_selected_pin_is_a_full_revision_outside_replaceable_liberty_cache() -> None:
+    dependency = source("pdk_ics55_pll")
+    assert dependency["revision"] == "6ebb1a8f7f4ccbccdb7f587664fdfe63cd39e61b"
+    assert dependency["url"] == "https://github.com/openecos-projects/ics55_ecos_pll.git"
+    assert dependency["destination"] == ".cache/retrosoc/sources/ics55_ecos_pll"
+    assert dependency["license"] == "NOASSERTION"
+
+
+def test_restore_records_hashes_and_reuses_clean_checkout_without_fetch(
+    locked_pll, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    upstream, dependency = locked_pll
+    first = setup.setup_ics55_pll()
+    destination = Path(first["destination"])
+    assert git(destination, "rev-parse", "HEAD") == dependency["revision"]
+    assert git(destination, "status", "--porcelain") == ""
+    assert first["sha256"] == {
+        name: hashlib.sha256((upstream / name).read_bytes()).hexdigest()
+        for name in setup.PLL_VIEWS
+    }
+    monkeypatch.setattr(setup_helpers, "run", lambda *_args, **_kwargs: pytest.fail("unexpected mutation"))
+    assert setup.setup_ics55_pll() == first
+
+
+def test_dirty_checkout_is_preserved(locked_pll) -> None:
+    record = setup.setup_ics55_pll()
+    readme = Path(record["destination"]) / "README.md"
+    readme.write_text("user changes\n")
+    with pytest.raises(RuntimeError, match="local changes"):
+        setup.setup_ics55_pll(update=True)
+    assert readme.read_text() == "user changes\n"
+
+
+def test_wrong_revision_requires_update_and_dirty_update_is_rejected(locked_pll) -> None:
+    upstream, dependency = locked_pll
+    record = setup.setup_ics55_pll()
+    destination = Path(record["destination"])
+    previous = dependency["revision"]
+    (upstream / "README.md").write_text("next reviewed revision\n")
+    dependency["revision"] = commit(upstream)
+    with pytest.raises(RuntimeError, match="rerun with --update"):
+        setup.setup_ics55_pll()
+    assert git(destination, "rev-parse", "HEAD") == previous
+    (destination / "README.md").write_text("local change\n")
+    with pytest.raises(RuntimeError, match="dirty dependency"):
+        setup.setup_ics55_pll(update=True)
+    assert git(destination, "rev-parse", "HEAD") == previous
+
+
+@pytest.mark.parametrize("missing", setup.PLL_VIEWS)
+def test_missing_view_cannot_be_accepted(locked_pll, missing: str) -> None:
+    upstream, dependency = locked_pll
+    (upstream / missing).unlink()
+    dependency["revision"] = commit(upstream)
+    with pytest.raises(ValueError, match="missing or empty"):
+        setup.setup_ics55_pll()
+
+
+@pytest.mark.parametrize("view", ["verilog/PLL_TOP.blackbox.v", "lef/PLL_TOP.lef", "lib/PLL_TOP_typ.lib"])
+def test_wrong_cell_identity_is_rejected(locked_pll, view: str) -> None:
+    upstream, dependency = locked_pll
+    path = upstream / view
+    path.write_text(path.read_text().replace("PLL_TOP", "OTHER_CELL"))
+    dependency["revision"] = commit(upstream)
+    with pytest.raises(ValueError, match="does not define PLL_TOP"):
+        setup.setup_ics55_pll()
+
+
+@pytest.mark.parametrize("pdks", [[], ["IHP130"], ["ICS55", "IHP130"], ["ICS55", "ICS55"]])
+def test_pll_component_rejects_ambiguous_or_wrong_pdk(pdks, monkeypatch) -> None:
+    argv = ["setup.py", "--component", "pll"]
+    for pdk in pdks:
+        argv += ["--pdk", pdk]
+    monkeypatch.setattr(sys, "argv", argv)
+    monkeypatch.setattr(setup, "setup_ics55_pll", lambda **_: pytest.fail("invalid selection installed PLL"))
+    with pytest.raises(SystemExit) as error:
+        setup.main()
+    assert error.value.code == 2
+
+
+def test_pll_only_does_not_prepare_other_inputs(locked_pll, monkeypatch) -> None:
+    monkeypatch.setattr(sys, "argv", ["setup.py", "--pdk", "ICS55", "--component", "pll"])
+    monkeypatch.setattr(setup, "archive", lambda *_: pytest.fail("PLL-only setup requested an archive"))
+    assert setup.main() == 0