The Seed-3 fit of the Ch443f scanout hardening exposed one setup family in the
EMIF (iopll_0_outclk0, 3.225 ns) domain: u_zc_emit|u_z|cache_dirty -> awaddr[*],
WNS -0.062 / TNS -0.203, skew-dominated (-0.064 clock skew; the 5-level logic
path itself would land ~+0.002 at zero skew). Not the Ch443f logic — the added
EMIF-domain logic nudged this marginal Ch357-era control path negative.
Fix (Codex-directed, minimal): the normal-eviction AW address is a pure function
of the cache line's beat, known when the line is installed. Preload it in S_FILL_C
alongside cache_beat<=pf_beat (awaddr <= ZBASE + (pf_beat<<5)), and drop the two
later awaddr assignments gated by cache_dirty (the scene_flush branch and the
dirty cache-miss branch) — those now only assert awvalid on the already-prepared
address. Clear-path awaddr assignments unchanged. No new FSM state, pipeline
stage, buffer, or protocol change.
Safe: a freshly filled line cannot be dirty before S_FILL_C installs it; the
address is stable across hits and scene flushes; after a dirty eviction the next
fill re-runs S_FILL_C; clear invalidates the cache so the first subsequent fill
overwrites the clear address before any normal eviction. This removes the control
cone rather than placing around it, so closure is seed-robust.
Regressions green: z_rmw/zc_emit/axi_master_elastic/zbuffer/z_flush_writer/
tile_zflush, full Ch443f scanout set, sh3_zint (Z 0/53760, COLOR 0/11092),
sh3_zrop (errors=0), and f52 byte-identity (Z 0/307200, COLOR 0/245760, drops=0).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
thejayman77
4110846c01