docs: certify C.9-C.14 + cross-cutting analyses D

C.9 (pinout): certified citing this session's own F1-F7 work; also
regenerated a real bitstream for the CURRENT full-system build
(ecppack, 0 errors, real part header) rather than relying on an older
pre-flash build's bitstream.

C.10 (timing): certified citing Fmax re-measured at every structural
change this session (54.58->75.30->73.88->66.68->67.91MHz), critical
path re-verified identical at every re-synthesis.

C.11 (toolchain): full RTL->Yosys->nextpnr-ecp5->ecppack flow re-run
on the current build, 0 errors at every stage. Real-silicon behavior
explicitly declared NOT certifiable (no physical hardware available).

C.12 (netasm): certified citing 20/20 tests plus a real hardware
round-trip already demonstrated earlier this session.

C.13 (datasheet/RTL coherence): real, current discrepancy found and
declared -- none of this campaign's 7 bugs (BUG-001-007) are yet
mentioned in the datasheet or engine spec doc. Correct and expected
(found after those docs were last updated), flagged as required
follow-up after the campaign completes.

C.14: page-mode PSRAM and the flash subsystem are actually COMPLETE,
not "in progress" as the certification prompt assumed -- verified
against real repo state.

D (cross-cutting): CDC certified via C.7. Reset scheme found by
exhaustive grep across all 20 RTL files to be synchronous-only
everywhere (no posedge rst anywhere) -- a real fact, differs from the
prompt's async-assert/sync-deassert phrasing, not a defect. FSM: the
campaign's own BUG-002-007 ARE FSM defects, found and documented, but
no exhaustive reachability analysis of every FSM was done (stated
reserve). Width/overflow: 2 real cases found across the whole session.
Lint: full-system Yosys check, one real warning (known PSRAM tristate),
zero accidental latches confirmed signal-by-signal (25 explicit
confirmations). Determinism: no real non-determinism found (the one
apparent inconsistency, BUG-003, traced to genuinely different test
stimuli between attempts, not unstable behavior for identical stimuli).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013xXuuRUWZScuo1DeYJxs3v

docs/validation/10-timing.md

@@ -0,0 +1,30 @@
+# C.10 — Timing (Fmax reale, percorso critico, sweep di seed)
+
+Data: 2026-09-04. Certificato per citazione di lavoro reale già svolto in questa stessa
+sessione, con numeri ri-misurati (non presi dalla parola di documenti precedenti) durante il
+lavoro sul sottosistema flash e sulla sua indipendenza elettrica (Fasi F1-F7).
+
+## Evidenza
+
+- **Fmax rimisurata ad ogni cambiamento strutturale rilevante**, non una singola cifra
+  presa per buona: 54.58 → 75.30 (timing closure) → 73.88 (pin attenzione host) → 66.68
+  (sottosistema flash) → **67.91 MHz (bus flash reso indipendente, Fase F7, build
+  corrente)** — ogni passaggio con log reale di `nextpnr-ecp5` citato, non un'affermazione.
+- **Percorso critico verificato esplicitamente identico** ad ogni ri-sintesi (non assunto
+  invariato): `u_graph_engine.u_neuron.group_index → u_mac8 → catena di riporto
+  dell'accumulatore in neuron_parallel.v` — stesso percorso dalla Fase 7 (timing closure)
+  fino alla build corrente con sottosistema flash, confermato leggendo il report di
+  `nextpnr-ecp5`, non presunto.
+- **Sweep di seed** (5 seed, P2 e P8) già eseguito e documentato in `WORKLOG.md`
+  ("Timing closure di `neuron_parallel`") — banda di rumore caratterizzata, usata per
+  distinguere un vero guadagno/perdita da rumore di piazzamento in tutte le ri-sintesi
+  successive di questa sessione (incl. la spiegazione del calo 73.88→66.68→67.91 MHz come
+  rumore, non regressione, verificata contro quella banda).
+- **Margine sull'oscillatore reale (16 MHz)** ricalcolato ad ogni passaggio: attualmente
+  4.24× con Fmax 67.91 MHz.
+
+## Verdetto
+
+**CERTIFICATO.** Nessun numero preso sulla parola: ogni Fmax citata in questo documento è
+stata effettivamente rimisurata con `nextpnr-ecp5` reale in questa sessione, non copiata da
+un documento precedente.