# R7 recorded-read capture audit

This helper qualifies the exact recorded-read input set shipped in `frozen-inputs.json`. It is self-contained in this checkout; it does not import ignored prototype directories. Source or timing-model changes require a new reviewed input manifest and audit.

From the repository root:

```sh
python3 scripts/read_capture_audit/verify_freeze.py .
bash scripts/build_ise.sh build/r7-test
python3 scripts/read_capture_audit/run_capture.py build/r7-test build/r7-read-audit
python3 scripts/read_capture_audit/test_capture_guards.py build/r7-read-audit
```

The audit refuses a build unless main, Normal and component timing pass and all 28 S6 synthesis input hashes (including `ProfileClock.v`, `SetupDisplay.v` and `SetupFont.v`) match. It copies the routed NCD/PCF/reports to a new directory, writes exact derived PCFs, runs NETGEN/XDL/TRACE, then checks report coverage, clock/FF topology, same-Q0 hold, held-data refill, receipt/ACK ordering and FPGA pin budgets. Derived PCFs and all generated evidence are sealed and rechecked; the implementation PCF is never edited.

`capture-summary.json`, `capture-focused.txt` and `as-inventory.json` are the results. Independent external, phase, Blitter-completion and CPU-retirement audits remain required. The AS inventory records primitive recovery/pulse requirements; unknown external CPU/card timing is not qualified. The 5 ns ACK setup reference is rated-speed SEC000 guidance, not a 60 MHz electrical guarantee.

See [R7 capture results](../../docs/r7-read-capture-timing.txt) for the selected route, equations, reserves and precise Normal exceptions.

This branch freezes S6 rather than the historical R7 image. Its write-strobe
admission guard and reset/profile ownership mask are checked explicitly.
Run `scripts/audit_profile_clock.py` on the completed capture-audit directory
to verify the routed clock-mux select margins.

S6 retains the CPU constraint at its fastest supported 60.2972184 MHz profile and
checks the 60 MHz clock-mux aperture. It retains S5's 5.75 ns TS22 budget;
the external audit accepts the historical 5.5/5.75 ns trials or the earlier 6 ns budget and
rejects relaxation. All other active interface budgets are unchanged.

S6 adds `read_fill_ready` on the falling CPU edge after the unchanged two
rising-edge synchronizer stages. The audit checks both its half-cycle input
and the full-cycle ready-to-receipt path, and inventories its AS reset path.
The earliest refill/data-lead calculation changes from 1.5/2 CPU periods to
2.5/3 periods because the actual pipeline gains one cycle. Main timing still
checks BRAM controls at the unchanged 60 MHz period; no path is waived.
