# R6 experiment: retain uncached read responses

**Routes 01/02 are not ready for hardware testing.** A final independently
delayed AS test exposed an admission/clear ordering fault: a new request can
be admitted while the old completion flag still suppresses read servicing,
yet acknowledgment later asserts. The internal latch timing checks below
remain valid within their scope; they did not establish this external-input
ordering. A revised fresh-cycle condition also exposed a separate synthetic
AS-release replay, so neither form is ready to promote. R5 is unchanged.

This is a private follow-up to the built R5 candidate. R4 remains the published,
board-tested image and a retained TF030 comparison. R5 was copied to the SD card
on September 15 at 14:27 EDT at the user's request, with an R4 backup. **No R6 hardware test or SD
copy has occurred.** The target is the same six-SRAM XC3S400-4-PQ208 Minimig;
no CPU-type switch or selectable clock is added.

Experimental version: **PI FMG260915R660Mhz**, fixed turbo **60.2972184 MHz**.
The main working tree remains on `work/r5-unified-cpu`. Exact R6 source and
maintained tests are preserved separately on `work/r6-held-read` in
`build/r6-source-worktree`. The retained comparison build is
`build/r6-held-return-02` (PAR seed 2), pending correction of the ordering fault.

## Why this change

The existing uncached read latch closes at chipset Q0, then opens again at Q2.
The internal read slot can already have retired, so an external transaction
that still holds AS can see inactive data. A prolonged Normal read can also
replay an internal read slot. These effects reproduce in generic CPU/SRAM and
CIA tests; they are not an identified TF030 card model or a proved cause of
its historical black screen.

The experiment retains the original latch-closing edge and acknowledgment
logic. Three small control registers recognize a fresh AS transaction, record
read completion at the original 7 MHz Q0 edge, and hold the latch closed from
Q1 until the next transaction. Completion stops repeated reads; writes retain
the original service logic. R5's held cached source is preserved.

An earlier four-register form used the related 28 MHz Q0 edge. Directed clock
skew exposed both premature data withdrawal and missed completion. It fails
12 of 36 cases that unchanged R5 passes, and was rejected before routing.
The three-register form passes all 36.

## AS ordering fault found after routing

The final delayed-input tests reproduce a new Normal-mode failure using
route-informed AS arrival paths: 4.5 ns to request admission and 7 ns to the
completion-clear condition. When AS falls 5 or 6 ns before Q0, the new request
is admitted, but the old completion flag still blocks service. ACK later
asserts with the previous word (`1357` instead of `1140`) and zero new SRAM
reads. The AS-high gap is over 400 ns. Exact R5 with the same admission delay
passes, as does the zero-extra-delay R6 control.

A generic independent-path stress reproduces the same effect in both modes,
but its ideal Turbo admission does not describe the actual route. Actual
routed Turbo paths do not establish the same nominal ordering gap.

The private seen-only alternative removes raw AS from the synchronous clear
condition. It passes the fall-arrival cases, 84 held/skew/CIA cases and 42
epoch/abort cases. It also passes release cases with the old route's delay
bounds. However, making the seen-clear path artificially fast while retaining
slower admission/ACK release causes one extra SRAM read in three of ten
AS-rise cases. This is synthetic ordering stress, not a measured board delay,
but shows that removing the falling-edge dependency alone is insufficient.

The frozen reproduction is `build/r6-as-admission/README.txt`, with a 228-file
manifest. The source worktree and routes below retain the original faulty
condition for comparison; the seen-only alternative has not been integrated.
A correction needs both service-count checks and new routed timing evidence.

The later bounded follow-up in `build/r6-return-sequencer` adds a guard based
on the held-latch and freshness state. The guard alone passes 27/30 cases;
three release cases still generate a late read pulse and Q0 sample even though
SRAM-Q1 counting misses them. Retaining the hold state across idle passes all
30 directed fall/rise cases with those additional monitors. It has not run the
broad suites, independent recovery/admission checks, first-completion release
checks or routed timing. It is not a promoted fix. The separate
`build/r6-as-admission-followup-review/README.txt` records the possible need to
couple ACK readiness to actual service admission and the unresolved external
adapter timing contract. No additional route or R6 package was produced.

## Functional evidence

The frozen experiment is in `build/r6-held-return-prototype`, including a
verified 354-file manifest, source snapshots, scripts and raw results.

- 60 held/late read cases, 8 SRAM/cache/DMA subset cases, 8 CIA/VPA cases,
  16 independent data/output-enable skew cases and 42 epoch/abort cases pass.
- The three hold/suppression/fresh-start fault injections fail with their
  exact intended errors. Compile errors and generic timeouts are rejected.
- All 24 PiStorm release cases, five cache-source transition cases, five
  bypass-restoration cases and the existing cache guard mutations pass.
- Three additional uncached → cache-only hit → uncached chains pass. Each
  cached hit starts and ends between 7 MHz edges.
- Twelve paired read scenarios have identical R5 and experimental CPU wait
  counts and sample times.
- The complete CPU/SRAM and retirement suites pass against the route source:
  137 cases / 39,456 transfers and 36 cases / 14,624 transfers respectively.
  All remaining groups in the common regression script also pass, including
  cache aliasing, contention, graphics, peripherals and full-core elaboration.

The separate R6 branch also passes its maintained `tests/cpu-return` group
(60 held/late, 16 release-skew, 8 CIA/VPA and three fault-injection controls)
and the updated complete CPU compatibility group. The latter preserves exact
R4 and R5 controls for the diagnosed short-gap defect below. Regression groups
were run in separate logged invocations against byte-identical build RTL;
unchanged groups were not repeated after the test harness was added.

### The synthetic 1 ns cache gap still fails

The maintained compatibility runner intentionally rejects this candidate's
changed negative-test signature: failure moves from access 1 to access 3.
That original R5 runner must not be reported as passing unchanged. Later
positive and mutation cases were executed separately with their original
strict checks. The separate R6 branch updates the exact expected access/data
signature and adds an unchanged R5 negative control alongside R4. This is an
expectation correction for a documented, still-unfixed defect.

Traces identify the same pending-refill mechanism. A 1 ns AS-high pulse can
leave an old refill scheduled into the new request. R5 overwrites a ROM cache
entry with the newly driven `ffff`; the experiment initially retains the
correct `1234`, hiding that first failure. After an uncached read, the pending
refill instead writes held `4567` into the new ROM address, causing access 3
to fail. Holding read data does not solve cache refill transaction separation.
This synthetic timing is separate from the passing 42 uncached epoch cases.

## Route selection

Private source snapshot: `build/r6-held-return-route-inputs`.
Full implementations: `build/r6-held-return-01` and `build/r6-held-return-02`.
The source is the frozen three-register prototype with a distinct R6 ID and
its unused test-observation wire removed; the other 24 build inputs match R5.

Main, Normal and component checks pass with the original timing constraints.
The external, phase, CPU-retirement and Blitter-completion audits also pass.
The additional latch-control audit passes on both routes, with exact source,
clock, endpoint and derived-constraint guards.

| Metric | R5 | R6 seed 1 | R6 seed 2 (comparison) |
| --- | ---: | ---: | ---: |
| Occupied slices / 3,584 | 3,554 | 3,551 | 3,551 |
| LUTs | 5,368 | 5,362 | 5,362 |
| Registers including 16 latches | 3,781 | 3,784 | 3,784 |
| XST warnings, none filtered | 53 | 53 | 53 |
| CPU slack | +3.315 ns | +4.755 ns | +3.004 ns |
| 28 MHz slack | +1.423 ns | +0.480 ns | +1.410 ns |
| 7 MHz slack | +4.806 ns | +0.533 ns | +3.709 ns |
| ACK path slack | +0.771 ns | +0.429 ns | +0.695 ns |

BRAMs/DCMs/global buffers remain 14/3/5. Seed 2 was selected to improve the
thin chipset margins of seed 1. Both routes have identical inputs and differ
only in PAR seed. No further seeds were tried and no timing limits changed.

This is a tradeoff: seed 2's external bus/cache ACK setup budgets are
+0.752/+1.407 ns after the existing 5 ns rated-speed reference and 0.5 ns
engineering allowance. They are 0.087/0.109 ns lower than seed 1's estimates,
because its forwarded CPU clock arrives earlier, while remaining above R4's
+0.417/+0.797 ns estimates under the same model. R6 is not a universal timing
improvement over R5. Held cache data has +18.278 ns under that model.

Selected-route phase input setup/hold is +13.850/+17.210 ns, and interstage
setup/hold is +14.146/+17.855 ns. The completion audit covers 141,700 paths
across 13 physical pins/four FFs, with minimum setup/hold +7.864/+1.228 ns.
These are scoped routed estimates and digital models, not board qualification.

## New latch-control timing

All sixteen latches retain the original inverted clk7 clock and use dedicated
gate-enable pins for the hold control. There is no new fabric-gated clock.
The selected route passes:

| New path/window | Minimum margin |
| --- | ---: |
| Q1 gate changes after original Q0 closure | +35.208 ns |
| Q1 gate settles before Q2 reopening | +27.702 ns |
| Completion withdrawal preserves returned-data hold | +3.938 ns |
| Retiring controls preserve completion sampling | +1.455 ns |
| Q0 completion/new-request state reaches Q1 destinations | +16.906 ns |

The clock-crossing windows use the existing additive 1.390 ns allowance;
same-clock hold checks include an extra 0.5 ns reserve. Equivalent PERIOD
coverage checks 5,025,178 paths / 80 physical latch endpoints and 638 paths /
two completion endpoints. Minimum latch setup/hold is +5.439/+1.318 ns;
completion setup/hold is +22.614/+1.753 ns. Guards check the frozen clock
source, actual DLL divide/phase, endpoint mapping, original constraints and
exact derived-constraint transformations.

The AS freshness inventory records 2.789–3.487 ns pad-to-reset delay,
0.883 ns FF recovery, and a conservative 1.561 ns pad-level AS-high pulse
requirement under the routed model. It does not establish the unknown
adapter's external timing. No removal check is emitted in the SDF; its
absence is not proof of a zero requirement. The asynchronous clear must also
reach completion logic before the first fresh Q0 setup deadline. These
conditions and the known synthetic 1 ns refill defect remain explicit limits.

Local audit source and reproducible evidence are retained under
`build/r6-held-return-audit`, with immutable route-01 and route-02 children.

## Exact rejected comparison-route identity

| Artifact | SHA-256 |
| --- | --- |
| `Minimig1.v` | `4285cb1837f8d5161b25e769a34835b946de9c7676d7e2d4fe48580f9481e7ed` |
| BIN | `48f7a208893d4fbac9621b5f4d3b4f8c99374910f2f2b065e15ea93d23bfb906` |
| BIT | `eb0a242b499e88e51f0fc714f84633102bc412e62a44d74bec7efed0939ac701` |
| NCD | `d6dd75974821d1d78247ef27750409de15750fe781b034a35ac96d33ff9db00f` |
| PCF | `67ddd898b60c72ff59baefa9490b9eb3f3213950366f370594a23bab85a7f99d` |

A separate read-only timing review identified a possible next optimization:
capture the SRAM address on every Q1 rather than gating that capture with
bank enable. Active cycles would retain identical addresses; inactive cycles
would change address only while every chip select is high. This could remove
the long bank-decode path from nineteen address-register enables, but is not
implemented or measured here. Other bank/control paths would remain.
