# Recorded CPU read-return tests

```sh
python3 tests/cpu-return/run.py --log build/cpu-return.log
```

The runner freezes the current RTL, project sources, benches and runner; logs
SHA-256 identities and each result; then checks that the inputs stayed unchanged.
`--rtl` can select another R7-compatible `Minimig1.v`. Production files are never
instrumented in place.

The group requires **44 positive cases, two explicit short-owner diagnostics,
and four specific failing mutations**:

- Ordinary and 320 ns held uncached reads, with exact SRAM service counts.
- Real CIA/VPA reads, including exactly two ICR interrupt clears per case.
- Twenty completed-read release cases: AS rises 1/4/6/8/12 ns before Q0,
  both CPU modes and both CCK parities. Independently delay AS reset of
  `read_as_seen` by 7 ns and apply data/OE delays of 2/10 ns.
- Raw read aborts at 40/50/60 ns after slot Q0, followed by a fresh read.
  Require zero SRAM writes and exactly one aborted plus one accepted SRAM read.
- Short pre-admission/near-Q0 aborts followed by a fresh request.
- Pending and interrupted reads behind an effective-AS owner mask. Ownership
  asserts/releases at Q0 and lasts 11 Q0 edges, reflecting the actual MIA
  clock domain and long ownership interval.
- The two deliberately short owner pulses show that AS masking does **not**
  immediately suppress old write strobes. They are recorded limitations,
  not a requirement that arbitrary owner pulses are safe. Real MIA ownership
  also uses Gary's independent host override.
- Actual full-core CPU1 ownership/reset wiring: all 32 input combinations,
  with read output and ACK parked in all 31 blocked combinations. This uses
  the real project and ISE UNISIM library; force statements isolate the
  Boolean connectivity test from clock/reset startup timing.
- Read cache BRAM writes occur after the held-word receipt and before external
  ACK, using the actual CPU/Gary/SRAM data path.

Negative controls remove synchronous service retention, remove the SRAM byte
write guard, remove fresh Turbo read-ACK ownership, or restore premature read
refills. Each must fail on its named functional assertion, not a compile error.
These controls complement the broader CPU/SRAM, compatibility, and retirement
suites in `scripts/run_regressions.sh`.

## Model limits

These are functional simulations, not TF534/TF536 firmware models or electrical
qualification. CPU clock delay, SRAM access/return delays, independent AS fanout,
and data/OE skew are explicit assumptions. In particular, direct Q0 data capture
still needs routed setup/hold analysis. AS recovery/removal and pulse-width
limits cannot be proven by these simulations.

The synthetic abort requester discards its canceled read instead of continuing
to sample data after releasing AS. It subsequently starts a fresh transaction.
This checks memory integrity and request ownership without claiming that every
arbitrary abort phase represents a normal 68000 instruction cycle.

Existing simplified cache/PiStorm fixtures separately hold their backend word
for 1 ns after clk28 Q0. That makes their related clk7 capture assumption
explicit; it is not an assertion that 1 ns satisfies the routed hardware hold
requirement. Actual SRAM and CIA tests here use their own data paths.
