docs+tools: workflow flowchart harness (P4) + drivers Tier-1/Tier-2 split

- tools/flowgen.py: generates docs/workflows/<name>.md — one outcome-first mermaid
  flowchart per workflow the SDK tests (hpmcu watchdog, modbus read, cru ladder,
  rga offload, relay drive, freshness contract), each stamped with its benchmark
  ns/op or 100% MC/DC result. Deterministic; reads the cargo-bench trend json.
- drivers/README.md: honest Tier-1 (relays + freshness, 100% MC/DC here now) vs
  Tier-2 (modbus/rga — serious testing + fault-injection + benchmarks via sim
  models; driver sources migrate in with the flare-edge unification) per ADR-0002/0005.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017wB8KB3MMQztRDXCMCkPrf

docs/workflows/README.md

@@ -0,0 +1,11 @@
+# Workflow flowcharts
+
+Generated by `tools/flowgen.py` from the modelled decision paths.
+Each is an outcome-first flowchart of a workflow the SDK tests, with its benchmark or MC/DC metric.
+
+- [HPMCU watchdog: arm → beat → fire](hpmcu-watchdog.md)
+- [Modbus RTU: read-holding-registers round trip](modbus-read-holding.md)
+- [CRU reset ladder: cause + boot-mode survival](cru-reset-ladder.md)
+- [RGA 2D offload dispatch](rga-offload.md)
+- [Relay drive (Tier-1, 100% MC/DC)](relay-drive.md)
+- [UI freshness contract (Tier-1, 100% MC/DC)](freshness-contract.md)

docs/workflows/cru-reset-ladder.md

@@ -0,0 +1,15 @@
+# CRU reset ladder: cause + boot-mode survival
+
+> **Outcome tested:** Reset cause is attributable and the boot-mode register survives a warm reset.
+
+**Benchmark** (`cru_poll`): 23.0 ns/op
+
+```mermaid
+flowchart TD
+  A[poll] --> B{global reset asserted?}
+  B -- no --> A
+  B -- yes --> C[record cause]
+  C --> D{power-on vs warm?}
+  D -- POR --> E[boot-mode cleared]
+  D -- warm --> F[boot-mode preserved]
+```

docs/workflows/freshness-contract.md

@@ -0,0 +1,19 @@
+# UI freshness contract (Tier-1, 100% MC/DC)
+
+> **Outcome tested:** The UI never shows a stale number: it holds briefly, then marks unknown.
+
+**Coverage**: freshness.c — 66/66 conditions, 100% MC/DC (CI-enforced)
+
+```mermaid
+flowchart TD
+  A[produce] --> B{result}
+  B -- OK --> V[render value, save last]
+  B -- SAME --> C{showing unknown?}
+  C -- yes --> V
+  C -- no --> N[no change]
+  B -- UNKNOWN --> D{ever had a value?}
+  D -- no --> U[render UNKNOWN mark]
+  D -- yes --> E{age > max_stale?}
+  E -- yes --> U
+  E -- no --> N
+```

docs/workflows/hpmcu-watchdog.md

@@ -0,0 +1,17 @@
+# HPMCU watchdog: arm → beat → fire
+
+> **Outcome tested:** A hung A7/flared ends in a counted reset, not a dark panel.
+
+**Benchmark** (`hpmcu_tick`): 1.8 ns/op
+
+```mermaid
+flowchart TD
+  A[flared loads SCR1 fw, releases core] --> B[MCU tick]
+  B --> C{mailbox magic == DISARM?}
+  C -- yes --> D[disarmed: never fire]
+  C -- no --> E{magic == ARMED?}
+  E -- no --> B
+  E -- yes --> F{beat counter advanced\nwithin deadline?}
+  F -- yes --> B
+  F -- no --> G[fire CRU global reset]
+```

docs/workflows/modbus-read-holding.md

@@ -0,0 +1,18 @@
+# Modbus RTU: read-holding-registers round trip
+
+> **Outcome tested:** A well-formed request yields the right registers; a bad one a defined fault.
+
+**Benchmark** (`modbus_read_holding`): 88.0 ns/op
+
+```mermaid
+flowchart TD
+  A[frame in] --> B{addr == mine\nor broadcast?}
+  B -- no --> Z[ignore]
+  B -- yes --> C{CRC ok?}
+  C -- no --> Z
+  C -- yes --> D{function code}
+  D -- 0x03 read-holding --> E{range in bounds?}
+  E -- no --> X[exception 0x02]
+  E -- yes --> R[registers response + CRC]
+  D -- unsupported --> X2[exception 0x01]
+```

docs/workflows/relay-drive.md

@@ -0,0 +1,20 @@
+# Relay drive (Tier-1, 100% MC/DC)
+
+> **Outcome tested:** A relay is exported transparently and driven without disturbing a held contact.
+
+**Coverage**: relays.c — 40/40 conditions, 100% MC/DC (CI-enforced)
+
+```mermaid
+flowchart TD
+  A[warden_relay_set idx,on] --> B{idx < COUNT?}
+  B -- no --> Z[no-op]
+  B -- yes --> C{exported?}
+  C -- no --> D[write export] --> E{exported now?}
+  E -- no --> Z2[give up]
+  E -- yes --> F
+  C -- yes --> F[read direction]
+  F --> G{dir == out?}
+  G -- no --> H[preserve level: read value,\nwrite high/low]
+  G -- yes --> I
+  H --> I[write value = on?1:0]
+```

docs/workflows/rga-offload.md

@@ -0,0 +1,15 @@
+# RGA 2D offload dispatch
+
+> **Outcome tested:** Blits go to the RGA when it succeeds, and fall back to the CPU when it doesn't.
+
+**Benchmark** (`rga_improcess`): 7.2 ns/op
+
+```mermaid
+flowchart TD
+  A[draw request] --> B{RGA compiled in\n(#if WARDEN_USE_RGA)?}
+  B -- no --> C[LVGL software draw]
+  B -- yes --> D[improcess src,dst,rects IM_SYNC]
+  D --> E{IM_STATUS == SUCCESS?}
+  E -- yes --> F[done on RGA]
+  E -- no --> C
+```