feat: update documentation for Tiny Gen1 R2 target

- Clarified integration details for WS2812 and XPI in respective documentation.
- Updated the SOC family positioning to reflect changes in clock/reset configurations and DMA channels.
- Enhanced README files for librelane and RTL to include R2 target specifics, including execution order and peripheral contracts.
- Specified the active execution order for R2 and clarified the implications of the new architecture on performance and integration.

docs/README.md

@@ -3,12 +3,14 @@
 This directory contains repository-level engineering policy that supplements
 the root README and subsystem guides.
 
-- [Tiny Gen1 QFN64](ip/tiny-soc.md) freezes shared RNG/CRC/WS2812/Crypto,
-  eight-channel DMA and Tiny-owned RCU, no-PLL 96 MHz / PLL 240 MHz clock and
-  reset trees, DVP V2 camera routing and optional XPI PSRAM frame buffers,
-  with the unchanged package budget. P10 -> P7 -> P8 -> P11 -> P12 -> P9 is
-  the remaining execution order; P0-P9 IDs/titles are preserved. These targets
-  remain separate from the existing 24 MHz implementation and physical evidence.
+- [Tiny Gen1 QFN64 R2](ip/tiny-soc.md) freezes dual CPU I/D paths, four
+  independent 32 KiB main-SRAM groups on the CPU's SYS clock, per-target AXI32
+  concurrency, eight-channel DMA scheduling and the existing shared-IP/camera
+  target without changing the package budget. The active roadmap is sequential
+  `TINY-R2-P0` through `TINY-R2-P11`; legacy `TINY-P0` through `TINY-P12`
+  remain in the linked contract history. CPU/main-SRAM rates up to 240 MHz
+  require qualification. These targets remain separate from the existing
+  24 MHz/four-channel implementation and physical evidence.
 - [Tiny Gen1 datasheet](../publications/datasheets/tiny/README.md) describes the
   current 24 MHz implementation, registers, software and qualification boundary;
   it does not yet describe the QFN64 Gen1 target.

docs/ip/README.md

@@ -4,12 +4,14 @@ This directory owns architecture, register ABI, software contract, and
 verification documentation for self-owned retroSoC peripheral IP and platform
 extension interfaces.
 
-- [Tiny Gen1 QFN64](tiny-soc.md) freezes shared RNG/CRC/WS2812/Crypto,
-  eight-channel DMA, Tiny-specific RCU and no-PLL 96 MHz / PLL 240 MHz clock
-  and reset trees while preserving the package/pad budget. P10 adds unchanged
-  DVP V2, GPIO12-23 ALT1 and optional XPI NSS1 PSRAM frame buffers; the execution
-  order is P10 -> P7 -> P8 -> P11 -> P12 -> P9 without renumbering old phases.
-  The current 24 MHz implementation and its evidence remain explicitly separate.
+- [Tiny Gen1 QFN64 R2](tiny-soc.md) freezes dual CPU I/D paths, four
+  independent 32 KiB main-SRAM groups at the CPU's SYS frequency, per-target
+  AXI32 concurrency and eight-channel DMA scheduling while preserving the
+  package/pad budget and shared-IP ABIs. XPI retains MEM; Crypto retains PCLK.
+  DVP V2 and optional NSS1 PSRAM remain the camera target. The active sequence
+  is `TINY-R2-P0` through `TINY-R2-P11`; legacy `TINY-P0` through `TINY-P12`
+  remain in the linked contract history. The current 24 MHz/four-channel
+  implementation and its evidence remain explicitly separate.
 
 - [timer.md](timer.md) defines the dual APB4 general timer.
 - [sysctrl.md](sysctrl.md) defines the APB4 SystemCtrl register ABI, control-plane contracts, HAL, and verification.
@@ -47,6 +49,8 @@ extension interfaces.
 - [mini-npu.md](mini-npu.md) retains historical commercial NPU research;
   its old platform assumptions and architecture direction are superseded.
 - [sdram.md](sdram.md) defines the AXI4 SDRAM data controller and APB4 configuration window.
+- [onchip-sram.md](onchip-sram.md) defines the shared SRAM ABI and technology
+  boundary, with a separate integration note for Tiny R2's planned bank groups.
 - [xpi.md](xpi.md) defines the native-AXI4/APB4 XPI V2 controller, commercial reference survey, LUT and PHY contracts, HAL, JTAG NOR programming, and delivery boundary.
 
 The corresponding RTL and HAL implementations remain the executable sources

docs/ip/dma.md

@@ -6,18 +6,25 @@ register and linked-list TCD operation. It is an APB4 configuration target at
 IRQ20. DMA does not use RIB or a RIB-to-AXI4 adapter.
 
 The register ABI, IP implementation and HAL are shared across products.
-The [Tiny Gen1 target](tiny-soc.md) keeps `0x1000A000`, IRQ20 and eight
+The [Tiny Gen1 R2 target](tiny-soc.md) keeps `0x1000A000`, IRQ20 and eight
 channels, but assigns channel 2 to DVP receive (general transfers only after
 camera ownership is released), 3 to XPI/WS2812/CRC,
 4/5 to Crypto and 6/7 to I2S TX/RX; 0/1 remain UART0/I2C0. Its streams and
-DMA engine share PCLK, with an AXI CDC into SYS. Product capability/routing
-data must reject absent endpoints without a blanket Tiny stream prohibition.
-Tiny DVP keeps request selector 11 and remains unsupported until its P12
-integration; a reserved/tied-off stream port is not support. The DVP stream
-can target XPI NSS1 mapped PSRAM using ordinary AXI writes without selecting
+DMA engine share PCLK, with an AXI CDC into SYS that preserves one outstanding
+read and one write. Main SRAM and its independent bank frontends run in SYS;
+there is no further SRAM CDC. Product capability/routing data must reject
+absent endpoints without a blanket Tiny stream prohibition.
+Tiny DVP keeps request selector 11 and remains unsupported until
+`TINY-R2-P9` integration; a reserved/tied-off stream port is not support. The
+DVP stream can target XPI NSS1 mapped PSRAM using ordinary AXI writes without selecting
 XPI's indirect DMA request or creating another master. Device capacity and
 serial-burst limits come from the initialized product memory configuration.
-These are frozen Tiny requirements, not implemented Tiny or timing evidence.
+Tiny's per-target concurrency and planned credit-bounded WS2812 batches are
+defined by the linked product contract. They retain this IP's direct/TCD,
+priority, abort-drain and completion ABI; finite TCD chains are not cyclic
+rings. `TINY-R2-P3` prepares scheduling and `TINY-R2-P6` integrates the eight
+channels. These are frozen Tiny requirements, not implemented Tiny or timing
+evidence; the committed Tiny baseline still has four channels.
 
 ## Scope and limits
 

docs/ip/dvp.md

@@ -21,14 +21,17 @@ capture, and rectangular cropping.
 | DMA request selector | `DVP_RX=11`; Mini default bulk DMA channel 3 |
 | ABI version | `0x00020000` |
 
-The [Tiny Gen1 target](tiny-soc.md) reuses this IP specification and ABI
+The [Tiny Gen1 R2 target](tiny-soc.md) reuses this IP specification and ABI
 unchanged at the same base/core IRQ, with product-selected DMA channel 2,
 PCLK host/stream, GPIO12-23 ALT1 camera routing and optional XPI NSS1 PSRAM
-frame buffers. Camera and I2S profiles are mutually exclusive. Its P12
-integration must validate exact transfer length, shared HAL channel/burst
-binding and final-word drain without changing the DVP registers, formats,
-FIFO or stream semantics. Tiny support remains a frozen target, not existing
-end-to-end or physical evidence; Mini's channel-3 default remains unchanged.
+frame buffers. Camera and I2S profiles are mutually exclusive. Its
+`TINY-R2-P9` integration must validate exact transfer length, shared HAL
+channel/burst binding and final-word drain without changing the DVP registers,
+formats, FIFO or stream semantics. The product contract requires measuring
+the existing 512-byte FIFO's stall budget and qualifying PSRAM transport in
+`TINY-R2-P8` before capture integration.
+Tiny support remains a frozen target, not existing end-to-end or physical
+evidence; Mini's channel-3 default remains unchanged.
 
 The pixel clock is buffered and can be inverted before the pixel-domain reset
 synchronizer. Configuration and frame statistics cross between the system and

docs/ip/i2s.md

@@ -11,12 +11,15 @@ and MCLK dividers. Host and audio clocks are independent; configuration uses
 ## Integration
 
 The following allocation describes the current Mini integration. The
-[Tiny Gen1 target](tiny-soc.md) preserves the common IP/host ABI and address,
+[Tiny Gen1 R2 target](tiny-soc.md) preserves the common IP/host ABI and address,
 uses core IRQ8 and central DMA channels 6/7 for TX/RX, and keeps host streams
 in PCLK while audio uses the separate pad-provided clock. Its GPIO routing
 and slave-mode requirement do not imply that the shared master-only RTL
-already implements them. A slave extension must update the common contract
-and driver rather than create a Tiny-only register interpretation.
+already implements them. `TINY-R2-P6` integrates the shared master path and
+`TINY-R2-P7` supplies its clock/reset context. The product contract defines
+DMA scheduling and contention acceptance without changing sample packing,
+FIFO depth or stream semantics. A slave extension must update the common
+contract and driver rather than create a Tiny-only register interpretation.
 
 | Property | Value |
 | --- | --- |

docs/ip/onchip-sram.md

@@ -12,6 +12,20 @@ The data aperture starts at
 physical capacity. A management-only APB4 window at `0x1001_7000` reports the
 configuration and saturating performance counters.
 
+The [Tiny Gen1 R2 target](tiny-soc.md) has a separate product integration
+contract: 128 KiB at `0x30000000..0x3001FFFF`, organized as four contiguous
+32 KiB arbitration groups with independent external AXI frontends and local
+CPU I/D paths. All main-SRAM physical macros and access/control logic share
+the CPU's SYS clock; no SRAM CDC or slower memory divider is introduced.
+The 24/96/192/240 MHz profiles are targets subject to macro and path timing
+qualification, not evidence that this shared module already implements the
+new topology. `TINY-R2-P4` owns that integration and preserves Mini's current
+datapath. Tiny retains `BANK_COUNT=32` and `BANK_BYTES=4096` as physical bank
+discovery; the four arbitration groups do not redefine the register ABI.
+Crypto's six private 4 KiB banks remain separate, additional PCLK storage.
+The linked product contract defines bank arbitration, performance accounting,
+clock/reset and verification requirements without adding shared MMIO registers.
+
 This release is a protocol and performance MVP. It is not a safety-certified,
 silicon-proven, or tapeout-ready memory subsystem. ECC, autonomous scrubbing,
 MBIST, redundancy repair, power gating, retention, and independently licensed

docs/ip/tiny-soc-verification.md

@@ -1,27 +1,216 @@
 # Tiny MCU Verification Record
 
-This record accompanies the [Tiny Gen1 contract](tiny-soc.md). It describes
-local implementation evidence from 2026-09-25 for the initial 24 MHz/no-PLL
-baseline, not a release or silicon signoff. The working tree was uncommitted
-when that evidence was collected; its recorded readiness remains `prototype`.
+This record accompanies the [Tiny Gen1 contract](tiny-soc.md). The active R2
+verification plan below covers Target SoCs: `TINY`, feature `tiny-soc`, and
+the approved performance refreeze. `R2` is a roadmap revision, not a new IP
+or register ABI version. The selected executable baseline remains
+`configs/ci/ihp130-tiny.mk`, IHP130, 24 MHz/no PLL; faster configurations and
+their physical acceptance do not exist merely because this plan names them.
 
-The baseline has two UARTs, two I2C controllers and the legacy pad mapping.
-These results do not validate the 2026-09-26 QFN64 package refreeze or the
-2026-09-30 shared-IP/clock/reset or 2026-10-01 DVP/XPI-framebuffer refreezes.
-The no-PLL 96 MHz / PLL 240 MHz targets, eight-channel DMA,
-RNG/CRC/WS2812/Crypto, Tiny RCU, I2S/SDIO and new
-clock/reset/pad integration, DVP and optional XPI PSRAM require separate
-current-revision evidence. The historical results below are retained without
-promotion to Gen1 qualification.
+The R2 freeze changes documentation only. All R2 firmware, RTL/formal,
+performance, synthesis/netlist, timing and physical results are **pending**.
+Historical `TINY-P0` through `TINY-P12` identifiers and evidence are preserved
+under their original scope; the mapping in the main contract transfers
+outstanding obligations without renaming old results or declaring them passed.
+Other PDK qualification, new SPI/PIO/BootROM IP and changes to QFN64 or the
+frozen IO/power-pad budget are outside this refreeze.
 
-## P6/P10 freezes and pending Gen1 verification
+The executed historical sections describe the 2026-09-25 initial baseline,
+with two UARTs, two I2C controllers and the legacy pad mapping. The working
+tree was uncommitted when that evidence was collected and its readiness
+remains `prototype`. Those results do not validate the later package,
+shared-IP/clock/reset, DVP/framebuffer or R2 performance refreezes.
 
-P6 and P10 are documentation-only. The remaining execution order is
+## R2 pending phase acceptance
+
+The following is the active monotonically increasing sequence. Every phase
+uses the preceding accepted R2 contract and its declared prerequisites; the
+old P10 -> P7 execution order below is historical. Documentation approval is
+not implementation acceptance. Final physical qualification is R2-P11 work,
+not a prerequisite to the architectural improvements in R2-P3 through R2-P5.
+
+| Active phase | Required evidence and completion boundary | Status |
+| --- | --- | --- |
+| TINY-R2-P0 - Performance Contract and Roadmap Freeze | Reviewable requirements, exact old/new phase mapping, invariant package/IO counts, same-frequency CPU/main-SRAM ownership, explicit performance budgets, links and commands. Record actual documentation checks separately. | Documentation freeze only; no hardware result |
+| TINY-R2-P1 - Reproducible Baseline, Constraints and Measurements | Reviewed source/profile/lock/tool identity; current 24 MHz functional and workload baseline; clocks, reset endpoints, constraints and timing-exception audit; counters and comparison methodology. Historical WNS is a risk reference, not a refreshed measurement. | Pending |
+| TINY-R2-P2 - Reset Distribution and CPU/SRAM Clock Feasibility | Reset distribution and payload-reset semantics; locked IHP130 main-SRAM macro timing, candidate common CPU/SRAM periods and representative paths; early clock/reset feasibility with explicit gaps. No final routed/PVT pass is implied. | Pending |
+| TINY-R2-P3 - Software and DMA Scheduling | Compiler and placement A/B results, finite DMA ownership, burst/chunk scheduling, WS2812 refill budget and workload correctness on the available platform. | Pending |
+| TINY-R2-P4 - Dual-Port Hazard3 and Four-Bank Local SRAM | Actual separate I/D paths, four independent 32 KiB bank frontends, SYS-clocked physical main-SRAM macros, local latency/fairness, FENCE.I, debug/reset and early inventory/SDC/macro-binding updates. | Pending |
+| TINY-R2-P5 - Per-Target Concurrent Fabric | Cross-target concurrency, one combined transaction per target, central-DMA read/write overlap, AW/W binding, errors, simultaneous faults/counters and accepted-transfer drain. | Pending |
+| TINY-R2-P6 - Shared IP and Eight-Channel DMA Integration | Legacy P7 obligations; shared PWM reporting, I2S slave and alternate-input-route prerequisites; common ABI/HAL parity; Crypto banks/lifecycle; truthful capabilities and affected Mini compatibility. | Pending |
+| TINY-R2-P7 - Tiny RCU and Dual-Mode Clock/Reset Integration | Legacy P8 obligations with main SRAM in SYS and XPI in MEM; atomic rate changes, all actual CDC/reset barriers, clock failures, WFI leaf gating and reserved DVP controls. | Pending |
+| TINY-R2-P8 - XPI PSRAM Framebuffer Bring-up | Legacy P11 obligations: real pin-level NSS1 device transport, CPU/DMA mapped-write readback, boundaries/recovery, payload rate and worst backpressure. | Pending |
+| TINY-R2-P9 - DVP Camera Profile and Frame Capture Integration | Legacy P12 obligations: unchanged DVP ABI/FIFO, DMA2/request 11, exact frame length, final-tail drain, snapshots/crops, missing-clock recovery and camera/audio exclusion. | Pending |
+| TINY-R2-P10 - System Performance and Regression Qualification | Complete current-profile functional regression and workload/contention A/B, measured real-time budgets, synthesis/macro mapping, netlist checks and explicit missing coverage. | Pending |
+| TINY-R2-P11 - IHP130 Physical and Product Qualification | Final joint CPU/main-SRAM timing, CTS/reset distribution, extracted PVT/IO/package/power evidence, qualified clock/PLL inputs and device operating points; close remaining legacy P9 obligations. | Pending |
+
+### R2 clock, reset and macro evidence
+
+The main 128 KiB SRAM includes its actual physical macro clock pins. It MUST
+use the same SYS source and active frequency as the CPU, with no hidden
+main-SRAM divider, CPU/main-SRAM CDC or half-rate fallback. The old P6/P10
+assignment of main SRAM to MEM is historical and is superseded for R2.
+Four logical 32 KiB banks do not mean four physical macros: verify the real
+IHP130 mapping and preserve the complete 128 KiB capacity. Crypto's six
+private banks remain additional storage in PCLK and retain their own lifecycle.
+
+| Target profile | CPU and actual main SRAM / SYS | XPI / MEM | Shared peripherals and Crypto / PCLK |
+| --- | ---: | ---: | ---: |
+| Safe boot | 24 MHz | 24 MHz | 24 MHz |
+| No-PLL fast, XIN96 | 96 MHz | 96 MHz | 48 MHz |
+| PLL I/O | 192 MHz | 96 MHz | 48 MHz |
+| PLL peak | 240 MHz | 120 MHz | 60 MHz |
+
+Also test external XIN24 and XIN48 at the declared 24/24/24 and 48/48/48 MHz
+SYS/MEM/PCLK rates. These are target cases, not qualified operating points.
+At 192/240 MHz the actual main-SRAM clock periods are approximately
+5.208/4.167 ns. R2-P2 must inspect the locked macro timing views, minimum
+period/pulse widths, setup/hold, clock-to-output and representative bank paths.
+Wait states or a registered response do not repair a violated macro minimum
+clock period. An unsupported target remains an explicit delivery gap; lowering
+the common CPU/SRAM rate requires a reviewed profile/contract change and must
+not silently restore CPU240/SRAM120. R2-P11 adds CTS, extracted parasitics,
+skew/uncertainty and actual macro/standard-cell PVT evidence before rate claims.
+
+R2-P1 audits the existing clock/reset inventory. R2-P4 updates it, the local
+path constraints and physical macro instance bindings as soon as the new bank
+hierarchy exists; it must not postpone those updates until RCU integration.
+R2-P7 adds dynamic SYS lifecycle, XPI MEM division and the actual domain
+bridges. CPU/main-SRAM accesses remain within SYS; DMA PCLK-to-SYS and
+SYS-to-XPI MEM crossings retain complete request/response and reset barriers.
+Main-SRAM control access follows SYS ownership. Rate reporting must make
+`SYS_HZ` authoritative for CPU/main SRAM and `MEM_HZ` authoritative for XPI.
+
+For clock transitions, acknowledge the RCU command before blocking new target
+admissions on both local CPU I/D and external AXI paths. Exercise continuing
+instruction fetch and data requests while draining all accepted bank operations,
+frontend responses and crossing state. Blocked-but-unaccepted requests must
+remain stable rather than refill the drain set; no accepted request may be
+lost, replayed or completed twice across the common SYS clock change.
+
+The existing WFI exception gates only the idle CPU leaf after its accepted
+work drains. It does not divide SYS or gate the main SRAM, fabric or DMA
+service paths. Verify IRQ/debug wake and ongoing DMA access while the CPU
+leaf is stopped. Cold/warm/watchdog/hart/peripheral reset, asynchronous
+assertion, five valid local release edges and CPU-last release all require
+directed evidence. Missing AUDIO/PIXCLK or software Crypto READY must not
+block CPU startup. A reset-done indication is not Crypto READY or ZEROIZED.
+
+For ordinary FIFOs, removing payload reset is permitted only after proving
+the existing observable empty/reset/flush behavior, no stale-word visibility,
+correct validity/pointer state and restart barriers. Main SRAM remains
+uncleared by reset. Crypto is not an ordinary payload-reset optimization:
+retain immediate invalidation, scalar clearing, full required SRAM
+write-zero/readback-zero sweeps and physical FIFO-payload erasure. Test late
+responses, stalled outputs, interrupted scrub and no early erasure success.
+
+### R2 functional and performance matrix
+
+Every row is pending and must identify its requirement, R2 phase, exact
+implementation, profile and executed test. Keep functional correctness and
+cycle-level performance distinct from physical frequency qualification.
+
+| Area / phases | Required cases and objective evidence |
+| --- | --- |
+| Independent banks and I/D paths, R2-P4/P5 | Exercise simultaneous I and D traffic to different banks plus DMA/SDIO traffic; prove each of the four 32 KiB banks has its own frontend and can serve independently. A bank decoder behind one serialized controller is insufficient. Cover every bank boundary, byte lane, first/last word and full-capacity/alias checks. |
+| Local service and fairness, R2-P4/P5 | Measure from accepted CPU AHB address phase to terminal data-phase completion, with clocks running, an uncontended bank, response capacity available and no lifecycle stall. The engineering budget is <=3 SYS cycles; report reads/writes and I/D separately. Report admission waiting separately so delayed acceptance cannot conceal latency. Same-frequency operation alone does not prove zero-wait service. Under contention, exercise beat-level bank grant fairness, maximum legal bursts and bounded service opportunities without violating AXI transaction ownership. |
+| Per-target admission, R2-P5 | Each target permits at most one combined read-or-write transaction until its B or RLAST response handshake. Independent targets may progress together. Cover all requester/target combinations, same-target serialization, backpressure and target/page/alignment errors; preserve VALID payload and response identity. |
+| DMA read/write overlap and AW/W, R2-P5/P6 | Central DMA may hold one outstanding read and one outstanding write; different targets overlap while same-target requests obey the combined target limit. Test W-before-AW, delayed W, stalled B/R, rejected writes and interleaved unrelated traffic. Bind every accepted W beat to the correct accepted AW owner/length; no reassignment or untagged write interleaving. |
+| Faults and counters, R2-P1/P5/P10 | Inject simultaneous faults and completions on different targets. Verify deterministic first-fault retention, correct requester/address/response, no lost independent fault events, correct aggregate count and source attribution. Backpressure must not recount a held event; concurrent events must not collapse into one boolean increment. Check clear/snapshot precedence and the frozen counter overflow semantics. |
+| CPU ordering and lifecycle, R2-P4/P5/P7 | Verify FENCE.I after data writes to executable SRAM, required store/response drain and instruction refetch. Exercise interrupts, debug halt/resume and hart reset with both I/D paths active; hart reset waits for accepted CPU work while unrelated DMA remains usable. Cold/system reset must discard the old session consistently, and graceful drains must retain all accepted responses. |
+| Compiler and placement A/B, R2-P3/P4/P10 | Use identical workloads, input/checksum, compiler identity, ISA/ABI and recorded flags. Separate compiler-only, bank-placement-only and combined comparisons; retain linker map, text/data/BSS/stack sizes and bank assignment. Compare cycles/instructions, I/D stalls, DMA throughput and latency against a reviewed baseline, not an unrelated historical build. Validate bank-aware code, data, stack and DMA-buffer placement and instruction synchronization. |
+| WS2812 finite refill, R2-P3/P6/P10 | Keep the existing register ABI and fixed-MMIO DMA path. With exclusive producer ownership, use watermark 8 and an observed FIFO level L to schedule at most min(remaining, 16-L) words. Exercise empty/full levels, short final chunks, stale observation with only consumer draining, timeout, abort and ownership release. Competing CPU/DMA producers must not invalidate the credit calculation; ownership and the submitted transfer remain finite. |
+| Real-time service budgets, R2-P3/P8/P9/P10 | Account for software/IRQ delay, arbitration, DMA, bridge/APB or serial service, maximum backpressure and margin. Prove the refill/service deadline against available FIFO slack under the declared competing traffic. Record WS2812 underrun/reset-gap behavior and DVP overflow invalidation; average throughput or bank count alone is not a worst-case guarantee. Unsupported traffic combinations must be explicit. |
+| Gen1 shared integration, R2-P6/P7 | Eight DMA channels and frozen channel/request bindings; RNG qualification rejection; CRC tails/FINISH; Crypto initialization/readback/lock, vectors and erasure; I2S/SDIO contention; dynamic PWM rate reporting, slave-audio and exclusive alternate-input prerequisites. Run affected Mini consumers without treating their results as Tiny evidence. |
+| XPI/DVP retained acceptance, R2-P8/P9/P10 | Execute the archived transport/frame cases below under the R2 phase mapping. Retain pin-level NSS1 PSRAM, measured write backpressure, exact frame length and guard/readback checks. DVP frame-done does not complete the final DMA word or AXI write response: never flush the undrained tail or publish a valid frame early. Preserve the DVP ABI/FIFO, DMA2/request 11 and capture-then-readback/save scope. |
+| Clock/reset, package and ABI, R2-P4/P7/P11 | Test the R2 domain ownership and lifecycle above, truthful staged capabilities, SRAM-only boot, fixed QFN64/32 GPIO/16 power-ground budget and unchanged frozen alternates. Maintain common addresses, IRQs, register/HAL parity and documented fault semantics; no new SPI/PIO/BootROM or extra IO is implied. |
+
+### R2 evidence classes and required validation
+
+| Evidence class | Required record | Claim boundary |
+| --- | --- | --- |
+| Functional | Actual Icarus and Verilator executions, strict terminal markers and result files, focused protocol/reset/error tests, and applicable formal/host tests separately identified | Does not establish performance or qualified clock rate |
+| Performance | Reproducible workload/compiler/placement A/B, cycle and instruction counts, service latency, throughput, contention and worst observed backpressure with stated workload bounds | A simulated clock assumption is not physical frequency evidence; observed maxima alone are not a universal bound |
+| Synthesis and netlist | Current IHP130 mapping of every main-SRAM/Crypto bank, area/cells, reset fanout, critical paths, netlist boot and applicable full-function checks | Library area is not die area; compact netlist boot does not replace full firmware or routed timing |
+| Physical | Actual source/profile/tool/PDK/corner/SDC identity; macro checks, CTS and reset distribution, extracted setup/hold and recovery/removal, CDC/RDC, IO/package/power and device timing | Behavioral PLL and pre-layout STA do not qualify an operating point or constitute foundry signoff |
+
+Each result must preserve commands, full logs, source revision, configuration
+digest, build variant, dependency/tool identity, library corners, simulator
+mode, workload and firmware identity. Record failures, skipped/no-op tests and
+missing artifacts explicitly. The historical -455.18 ns WNS below belongs to
+the original 2026-09-25 run; it is not the current R2 WNS or proof that any
+new rate is achievable. Physical feasibility and final qualification require
+new evidence for the actual CPU/main-SRAM clocks and reset distribution.
+
+Use the implementation validation entrypoints and baseline commands in the
+[main contract](tiny-soc.md), with directed R2 cases and any new committed
+profiles added through the normal flow. The current IHP130 Tiny profile
+remains the starting point. Register integrated cases in normal regression;
+`tests/test_xpi_io.py`, `tests/test_dvp.py`, fast-flash and host-only tests do
+not replace the complete required hardware route. Preserve strict
+`SIM_TEST_PASS`/result-file verdicts and run affected Mini compatibility for
+shared changes. Do not remove unsupported PLL/STA guards, alter dependencies,
+or change warning/metric policy to manufacture a pass. Metrics remain observe
+mode; synthesis, simulation and timing failures remain recorded failures.
+
+No R2 test, benchmark or PPA result is claimed by this verification-plan edit.
+Actual documentation-only validation is recorded separately after execution.
+
+## R2-P0 documentation checks (2026-10-04)
+
+The working-tree documentation checks passed:
+
+- Package, power and GPIO tables match the preceding contract; all 64
+  perimeter numbers remain unique and the 32 GPIO assignments are unchanged.
+- All 13 legacy phase headings and planning bodies are preserved, while the
+  12 approved R2 headings are unique and sequential. Requirement identifiers
+  TINY-001 through TINY-036 are unique and ordered.
+- The four contiguous 32 KiB ranges total 128 KiB and retain 32 physical
+  4 KiB macros. SYS and XPI MEM table values match the same-frequency contract.
+- The initial 24 MHz architecture block and the executed historical record
+  from "Configuration and artifact roots" onward match the preceding revision.
+- All 119 local Markdown links across the 13 changed documents resolve;
+  referenced profile, CPU/device-model sources and test entrypoints exist.
+- The local-admission clock-change rule and three-cycle latency measurement
+  endpoints were cross-checked between the main contract and this matrix.
+
+The selected executable profile remains `configs/ci/ihp130-tiny.mk`, IHP130,
+24 MHz/no PLL. The following commands passed; Windows used the installed
+`python` entrypoint for the two command-list checks:
+
+```sh
+python scripts/regress.py --root . --suite pr --pdk IHP130 --soc TINY --dry-run
+python scripts/regress.py --root . --suite nightly --soc TINY --dry-run
+git diff --check
+```
+
+These are documentation and command-selection checks, not R2 hardware
+results. No RTL, firmware, configuration, dependency, warning-baseline or
+metrics-policy file is changed. No C/MISRA deviation is introduced. Firmware
+compilation, RTL/formal simulation, full quality/regression suites, synthesis,
+netlist, STA and physical qualification were not run in this documentation
+phase. Actual main-SRAM macro timing and joint high-frequency qualification
+remain pending; no SRAM or CPU maximum frequency is established here.
+
+## Archived P6/P10 planning and documentation evidence
+
+The remainder of this section preserves the prior planning and P10 document
+checks under their original phase identifiers. Its P7/P8/P11/P12/P9 labels,
+three-master topology and main-SRAM-in-MEM clock assumptions are historical,
+not the active R2 architecture or order. R2-P6/P7/P8/P9 retain the applicable
+shared-IP, RCU, XPI and DVP acceptance obligations, while R2-P1/P2/P10/P11
+carry the outstanding baseline and qualification work. Apply the R2
+clock/fabric requirements above when executing those retained tests.
+
+### Archived P6/P10 pending Gen1 verification
+
+P6 and P10 were documentation-only. Their recorded execution order was
 P10 -> P7 -> P8 -> P11 -> P12 -> P9, preserving all P0-P9 phase IDs/titles.
-The matrix below specifies required implementation and qualification coverage;
-it records no newly executed RTL, firmware, formal, synthesis or timing result.
-The existing committed IHP130 Tiny profile remains the 24 MHz baseline until
-the implementation phases introduce reviewed configurations.
+The matrix below recorded required implementation and qualification coverage;
+it recorded no newly executed RTL, firmware, formal, synthesis or timing result.
+The existing committed IHP130 Tiny profile remained the 24 MHz baseline until
+implementation introduced reviewed configurations. Pending entries below are
+historical status, not new R2 results.
 
 | Area | Required cases / acceptance | Evidence status |
 | --- | --- | --- |

docs/ip/ws2812.md

@@ -8,13 +8,21 @@ error state, and a GPIO alternate-function output.
 
 ## Integration
 
-The table describes the current Mini binding. The [Tiny Gen1 target](tiny-soc.md)
+The table describes the current Mini binding. The [Tiny Gen1 R2 target](tiny-soc.md)
 retains the address, IRQ17, register ABI and HAL, but routes the output to
 GPIO26 ALT0 (QFN pin 11). Tiny bulk DMA channel 3 supplies fixed TXDATA writes.
 Product routing and the actual PCLK frequency are supplied to the common
 GPIO/timing APIs; they are not a second WS2812 driver. Tiny's binding and
 PCLK24/48/60 timing require their own implementation evidence.
 
+Tiny's `TINY-R2-P3` scheduling contract selects FIFO-low watermark 8 and finite
+DMA batches bounded by observed free FIFO credits, with implementation and
+contention acceptance carried into `TINY-R2-P6`. See the linked product
+contract for ownership, refill timing and recovery requirements. This is
+planned shared transport work, not the behavior of the current full-tail DMA
+helper. It preserves this IP's full-FIFO APB backpressure, register/FIFO ABI
+and software request selection; an autonomous credit sideband remains deferred.
+
 | Property | Value |
 | --- | --- |
 | APB4 base address | `0x10008000` |

docs/ip/xpi.md

@@ -18,13 +18,16 @@ definitions remain the executable sources of truth:
 
 XPI V2 intentionally breaks the retired `qspi.h` register and HAL ABI.
 
-The [Tiny Gen1 target](tiny-soc.md) retains this shared XPI register/LUT/PHY
+The [Tiny Gen1 R2 target](tiny-soc.md) retains this shared XPI register/LUT/PHY
 contract and selects optional NSS1 PSRAM at `0x54000000` with GPIO29 ALT0.
-NSS0 remains the boot NOR path; SRAM-only operation is preserved. Tiny P11
-must validate initialization, actual capacity, mapped CPU/DMA writes, serial
-boundaries/CS timing and transport bandwidth before P12 DVP capture uses the
-RAM. Frames use DVP request 11 and ordinary DMA AXI destination writes, not
-the XPI indirect TX path. No extra PSRAM controller/window, XPI ABI change or
+NSS0 remains the boot NOR path; SRAM-only operation is preserved. XPI remains
+in MEM at the selected 24/96/96/120 MHz target while CPU and main SRAM share
+SYS; SYS-to-MEM CDC remains at the XPI boundary. `TINY-R2-P8` must validate
+initialization, actual capacity, mapped CPU/DMA writes, serial boundaries/CS
+timing and transport bandwidth before `TINY-R2-P9` DVP capture uses the RAM.
+The product contract retains this IP's nonpreemptible physical-command and
+no-cache behavior. Frames use DVP request 11 and ordinary DMA AXI destination
+writes, not the XPI indirect TX path. No extra PSRAM controller/window, XPI ABI change or
 qualified camera/PSRAM rate is implied by the documentation freeze.
 
 ## Commercial Reference Survey

docs/soc-family-positioning.md

@@ -52,26 +52,27 @@ integration in `rtl/tiny`, selected with `configs/ci/ihp130-tiny.mk`. It has no
 wireless IP, wireless protocol stack, or radio-specific companion integration.
 Tiny-Connect, BLE, IEEE 802.15.4 and Wi-Fi are deferred product research.
 
-The committed baseline still uses 24 MHz, no PLL, two UARTs, two I2C
-controllers and legacy pad routing. The QFN64 Gen1 product/package target
-was established on 2026-09-26 and extended on 2026-09-30 with shared IP,
-eight-channel DMA and explicit no-PLL/PLL clock and reset trees. The
-2026-10-01 P10 refreeze adds DVP V2 camera routing and optional XPI PSRAM
-frame buffers. The remaining order is P10 -> P7 -> P8 -> P11 -> P12 -> P9;
-old phase IDs/titles are preserved. Existing generated datasheets describe
-the baseline, not completed implementation of the refreeze.
+The committed baseline still uses 24 MHz, no PLL, four DMA channels, two
+UARTs, two I2C controllers and legacy pad routing. The QFN64 Gen1 target was
+established on 2026-09-26, extended with shared IP and clock/reset requirements
+on 2026-09-30, and with DVP/XPI frame buffers on 2026-10-01. The 2026-10-04
+[R2 performance contract](ip/tiny-soc.md) replaces the remaining execution
+order with sequential `TINY-R2-P0` through `TINY-R2-P11`; the original
+`TINY-P0` through `TINY-P12` IDs/titles remain in that contract's history.
+Existing generated datasheets describe the baseline, not completed R2
+implementation or qualification.
 
 ### Gen1 Product and Package Target
 
 | Area | Tiny Gen1 target |
 | --- | --- |
-| CPU | One Hazard3 RV32IMC hart; A extension disabled until atomic bus semantics are qualified |
-| On-chip memory | 128 KiB user SRAM plus six private Crypto banks (24 KiB); larger user SRAM and retention deferred |
+| CPU | One Hazard3 RV32IMC hart with independent local I/D paths; A remains disabled |
+| On-chip memory | 128 KiB user SRAM in four contiguous 32 KiB arbitration groups, with independent frontends and physical macros at CPU SYS frequency; six private Crypto banks (24 KiB) remain PCLK |
 | Code storage | XPI NOR boot, loaded into SRAM; authenticated recovery boot deferred |
 | Memory model | No MMU, HP hart or external RAM boot dependency; optional initialized XPI NSS1 PSRAM for whole-frame data, bounded by actual device capacity |
-| Interconnect | AXI32 with CPU, central DMA and SDIO private-DMA masters; APB4 control and explicit domain bridges; no RIB/RIBP |
-| Software | Shared peripheral specifications, addresses and HAL source; product-specific RCU/SYSCTRL backend and routing/clock configuration; RV32IM compiler target |
-| Clock/reset | Safe REF24 boot; external-XIN no-PLL up to 96 MHz or a 24 MHz reference/single-output PLL up to 240 MHz; MEM up to 120 MHz, PCLK up to 60 MHz, fixed 1 MHz CLINT tick; no independent safety RC |
+| Interconnect | Per-target concurrent AXI32 with three external owners: CPU non-SRAM I/D merge, central DMA and SDIO private DMA; independent local SRAM I/D paths, APB4 control and explicit domain bridges; no RIB/RIBP |
+| Software | Shared peripheral specifications, addresses and HAL source; product-specific RCU/SYSCTRL backend and routing/clock configuration; compatible RV32IM build plus separately validated performance compiler/linker configuration |
+| Clock/reset | CPU and main SRAM share SYS at 24/96/192/240 MHz targets; XPI MEM at 24/96/96/120 MHz; PCLK at 24/48/48/60 MHz; no main-SRAM CDC, fixed 1 MHz CLINT tick, no independent safety RC; all faster profiles require qualification |
 | Edge I/O | 32 user GPIO, one UART, one I2C, one full-duplex master/slave I2S target, alternate 8-bit DVP V2 camera profile, one 3.3 V 1-bit/4-bit SDIO host, two timers, eight central DMA channels, four PWM outputs, RTC, watchdog and XPI |
 | Shared services | RNG V2, CRC V2, WS2812 and Crypto V2 at Mini-compatible addresses; entropy and security claims require separate qualification |
 | Package | QFN64 plus separate EP: 48 signal and 16 power/ground terminals; preferred 9 x 9 mm, 0.5 mm pitch pending physical review |
@@ -88,10 +89,13 @@ GPIO27/28/30/31. CAM_XCLK and GPIO28 CLKOUT share one RCU generator.
 Independent boot Flash and JTAG remain available. DVP retains the shared V2
 ABI at `0x1000E000`/IRQ15 and uses DMA2/request 11; frames may exceed internal
 SRAM through NSS1 at `0x54000000` without adding a master or controller.
-The shared-IP addresses, DMA/IRQ allocations, Tiny RCU bank
-and clock/reset behavior are frozen targets, with implementation in P7/P8,
-PSRAM transport in P11, DVP capture in P12 and
-physical acceptance in P9. SDIO reaches target clocks of 48 MHz at SYS96/192
+The R2 roadmap places software/DMA scheduling in `TINY-R2-P3`, local CPU/SRAM
+integration in `TINY-R2-P4` and the concurrent fabric in `TINY-R2-P5`.
+Shared-IP/eight-channel integration follows in `TINY-R2-P6`, RCU/clock/reset
+in `TINY-R2-P7`, PSRAM transport in `TINY-R2-P8`, and DVP capture in
+`TINY-R2-P9`; system and physical qualification are `TINY-R2-P10` and
+`TINY-R2-P11`. The canonical contract retains the legacy phase mapping.
+SDIO reaches target clocks of 48 MHz at SYS96/192
 and 40 MHz at SYS240 using the existing integer divider. XIN loss stops the
 reference/watchdog domain too; recovery requires the external source and
 RESET_N. The historical AXI/ABI and verification sections still describe the
@@ -441,7 +445,7 @@ software quality.
 
 | Tier | Claim gate |
 | --- | --- |
-| Tiny | Gen1 target: unchanged QFN64, shared IP/eight-channel DMA, product RCU/CDC/reset, no-PLL 96 MHz and PLL 240 MHz evidence, DVP snapshot/crop to optional XPI PSRAM with measured transport and Pad timing; low-power, entropy and security claims require separate qualification |
+| Tiny | Gen1 R2 target: unchanged QFN64, dual local I/D and four main-SRAM groups at CPU SYS frequency, per-target AXI32 concurrency, shared IP/eight-channel DMA, RCU/CDC/reset, CPU/SRAM 96/192/240 MHz qualification, DVP snapshot/crop to optional XPI PSRAM with measured transport and Pad timing; low-power, entropy and security claims require separate qualification |
 | Mini | Repeatable Linux boot, at least 64 MiB usable main memory, native memory bursts, and management-controlled start/stop recovery |
 | Std | Full AXI4 ordering tests, coherent accelerator traffic, 1080p60 graphical desktop, audio playback, and NPU inference under concurrent DMA load |
 | Pro | Four-hart coherent SMP stress, RV64 distribution boot, more-than-4-GiB memory validation, and concurrent GPU/NPU/video operation |

physical/librelane/tiny/README.md

@@ -5,6 +5,13 @@ entry point: `librelane-chip` implements the bare-die `retrosoc_tiny_asic`
 MCU, including its pad ring, bondpads, fillers, corners, seal ring, and the
 32 on-chip SRAM bank macros.
 
+The pad counts, 24 MHz constraints and observations below describe the
+committed initial implementation. The [Tiny Gen1 R2 target](../../../docs/ip/tiny-soc.md)
+preserves the frozen QFN64 package. `TINY-R2-P4` updates macro hierarchy and
+SYS-clock constraints, `TINY-R2-P7` updates dynamic clock/reset inputs, and
+`TINY-R2-P11` performs final CPU/main-SRAM physical qualification. This guide and an existing flow run
+do not qualify the R2 pad mapping or faster CPU/SRAM profiles.
+
 The flow consumes the committed `configs/ci/ihp130-tiny.mk` profile, the
 canonical Tiny pin map (`rtl/tiny/pin_map/pin_map.json`), the Tiny clock/reset
 inventory (`rtl/tiny/integration/clock_reset_domains.json`), and the

rtl/tiny/README.md

@@ -1,7 +1,7 @@
 # Tiny MCU Integration
 
 Tiny is the independent single-Hazard3 wired MCU product. Its frozen target
-contract is [Tiny Gen1 QFN64](../../docs/ip/tiny-soc.md). Use
+contract is [Tiny Gen1 QFN64 R2](../../docs/ip/tiny-soc.md). Use
 `make CONFIG=configs/ci/ihp130-tiny.mk setup` followed by
 `make CONFIG=configs/ci/ihp130-tiny.mk firmware sim`.
 
@@ -19,24 +19,33 @@ are outside this release. Run both Icarus and Verilator, the Tiny directed
 tests, and the IHP130 regression before claiming qualification. Synthesis and
 STA use the Tiny top and clock inventory, not Mini constraints.
 
-The 2026-09-30 P6 target adds shared RNG/CRC/WS2812/Crypto, eight-channel DMA
-and a Tiny-owned RCU/SYSCTRL, with no-PLL 96 MHz and single-output-PLL
-240 MHz limits. It preserves QFN64 and adds WS2812 on GPIO26 ALT0. The
-committed RTL/profile still describes the initial 24 MHz/no-PLL implementation;
-P7/P8 must implement the new addresses, streams, clock domains,
-reset barriers and shared-driver compatibility. No PLL macro/timing support
-is implied by the new specification or the `HAVE_PLL` selector alone.
+The 2026-10-04 R2 target preserves QFN64, the existing peripheral contracts,
+eight-channel DMA, Tiny RCU and the DVP/XPI framebuffer target. It adds dual
+CPU I/D paths to four contiguous 32 KiB main-SRAM arbitration groups, each with
+independent request/response state and an external AXI frontend. CPU and all
+main-SRAM macros share SYS at the selected 24/96/192/240 MHz target; no SRAM
+CDC or slower SRAM divider is introduced. Only non-SRAM CPU I/D requests merge
+into the external path, preserving three external owners with central DMA and
+SDIO. Per-target arbitration replaces the global transaction lock. XPI stays
+in MEM at 24/96/96/120 MHz and Crypto's six private banks remain PCLK.
 
-The 2026-10-01 P10 documentation refreeze adds the existing DVP V2 contract,
-camera GPIO12-23 ALT1 (mutually exclusive with I2S), DMA2/request 11 and
-optional XPI NSS1 PSRAM at `0x54000000` through GPIO29. Whole-frame external
-storage does not change the 128 KiB SRAM, NOR boot, QFN64/power budget or
-three-master/eight-channel target. CAM_XCLK shares RCU CLKOUT; RCU target 14
-and DVP endpoint capabilities remain unsupported until actual integration.
-The remaining order is P10 -> P7 -> P8 -> P11 (PSRAM transport) -> P12
-(camera capture) -> P9 (system/physical qualification). P11/P12 require real
-pin-level XPI PSRAM and full-frame readback, not fast-flash or the separate
-PSRAM controller's tests. No camera/PSRAM rate is qualified by this freeze.
+The active execution order is sequential `TINY-R2-P0` through `TINY-R2-P11`
+in the linked contract. Software/DMA scheduling is `TINY-R2-P3`, local CPU/SRAM
+`TINY-R2-P4`, concurrent fabric `TINY-R2-P5`, shared-IP/eight-channel integration
+`TINY-R2-P6`, RCU `TINY-R2-P7`, XPI PSRAM `TINY-R2-P8`, camera capture
+`TINY-R2-P9`, system qualification `TINY-R2-P10` and IHP130 physical
+qualification `TINY-R2-P11`. Legacy `TINY-P0` through `TINY-P12` remain in
+the contract history. The committed RTL/profile still implements the initial
+24 MHz/no-PLL/four-channel design; no faster CPU/SRAM or PLL timing support
+follows from this freeze or the `HAVE_PLL` selector alone.
+
+Camera GPIO12-23 ALT1 remains mutually exclusive with I2S. DMA2/request 11,
+optional XPI NSS1 PSRAM at `0x54000000` through GPIO29 and shared CAM_XCLK
+retain their existing target contracts. RCU target 14 and DVP capabilities
+stay unsupported until actual integration. `TINY-R2-P8` and `TINY-R2-P9`
+require pin-level XPI PSRAM and full-frame readback, not fast-flash or
+separate-controller evidence.
+No camera/PSRAM rate is qualified by this freeze.
 
 `make CONFIG=configs/ci/ihp130-tiny.mk regress-pr` runs only Tiny's IHP130
 matrix. The regression runner also accepts `--soc TINY`; leaving it unset