kernel/rv1106: capabilities audit — correct stale reason cells

mailbox + NPU + pvtm all now show VERIFIED with accurate notes (the prior
reason cells still said 'unexercised'/'no userspace'/'deferred'). Only
crypto-accel (CPU crypto covers) and open-NPU-compute (person-year RE) remain,
both documented.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

kernel/rv1106-enablement/CAPABILITIES-AUDIT.md

@@ -24,17 +24,20 @@ PWM backlight · **USB host** (dwc3/xhci) + usb2phy · grf/pmu syscons.
 ## ✅ audio — VERIFIED this run
 card `rv1106-acodec` + pcmC0D0p/c (`audio/`); audible test @ bench with display.
 
-## ⬜ Remaining — final honest ledger (each is deferred for a stated reason, not an unexplored gap)
+## Remaining blocks — final status (all real capabilities now verified)
-| Block | verdict | reason |
+| Block | verdict | note |
 |---|---|---|
-| **mailbox** (HPMCU) | ✅ VERIFIED | the rv1106 node carries a `rockchip,rk3368-mailbox` **fallback** → mainline's driver binds it with **zero code change**. But nothing in our kernel is a mailbox *client* (the coprocessor R5 path is /dev/mem today), so an enabled controller would register unexercised. Enable it the day a coprocessor mailbox client lands — DT `status="okay"` + `MAILBOX`/`ROCKCHIP_MBOX=y`, no port. |
+| **mailbox** (HPMCU) | ✅ VERIFIED | A7↔RISC-V-SCR1 round-trip, 5/5 exact echoes (`mailbox/VERIFIED.md`). Took 3 hardware-found fixes: rv1106 num_chans=1 (1 shared IRQ, not 4), CLK_CORE_MCU IGNORE_UNUSED (6.18 was gating the coprocessor clock), + an open SCR1 echo firmware with A2B_INTEN. The /dev/mem SRAM watchdog stays as a separate dead-man's-switch. |
-| **crypto-v3** (accel) | deferred | ~100KB whole-subsystem replacement of mainline's rk3288 crypto + heavy crypto-API deltas, and the **CPU crypto extensions (AES/SHA, batch2 =y) already cover the functional need** — an offload optimization, not a capability gap. |
+| **NPU** (rknpu) | ✅ open driver VERIFIED; compute deferred | open GPL rknpu 0.9.2 driver, /dev/dri/card1, version ioctl PASS (`npu/VERIFIED.md`). Open *compute* (a regcmd compiler) is a from-scratch ~person-year register-RE project — no RV1106 prior art, no public TRM Part 2, mainline accel/rocket+Teflon are RK3588-only. Ship the driver, no blob. |
-| **NPU** (rknpu) | ✅ open driver VERIFIED; compute deferred | kernel driver ports, but **no open userspace regcmd runtime exists** — it would register with nothing able to submit jobs openly. Needs an open encoder first (`npu/PORT-PLAN.md`, graphics investigation). |
+| **pvtm** | ✅ VERIFIED | both core+pmu PVT monitors probe; debugfs ring-osc reads (`pvtm/PORT-DONE.md`). |
-| **pvtm** | deferred | PVT monitors are only useful for DVFS, which we don't run. |
+| **crypto-v3** (accel) | deferred (documented) | ~100 KB whole-subsystem replacement of mainline's rk3288 crypto + heavy crypto-API deltas; the **CPU crypto extensions (AES/SHA, batch2 =y) already cover the functional need** — an offload optimization, not a capability gap. |
 | camera/ISP, SPI | N/A | no such hardware on the 86-Panel. |
 
 **Conclusion:** every RV1106 block with real, exercisable value on the panel is
-ported + verified on 6.18. What remains is documented above — no unexplored gap.
+ported + verified on 6.18 — including the mailbox and the open NPU driver. The only
+deferred item is the crypto *accelerator* (CPU crypto already covers it) and open
+NPU *compute* (a person-year RE effort, scoped in `npu/OPEN-NPU-PLAN.md`). No
+unexplored gap remains.
 
 ## ❌ Not applicable (no hardware on the 86-Panel)
 cif · csi2-dphy · mipi-csi2 · rkisp (all camera/ISP) · SPI (no on-board SPI device).