P117 adds the one-entry speculative target-buffer state that P116 said
was missing, then deliberately leaves issue guarded off in the passing
RTL. The live buffer-on run was useful but not correct: Linux reached
/init, then BusyBox faulted on a store to badaddr=0x00000000.
check
result
Verilator build
PASS
BusyBox shell workload reaches P117-FILE-OK with issue guarded off
PASS
Live speculative target-buffer issue
FAIL
Buffer counters visible in JSON
PASS
Hardened layout
NOT RUN
counter
value
userspace steering candidates
215,013
steering issues
0
buffer fills
0
buffer promotes
0
buffer discards
0
blocked unaligned
119,771
blocked TLB/permission
62
FTQ fills
54,059,898
FTQ consumes
54,059,898
FTQ flushes
0
metric
P116
P117
shell window cycles
65,806,663
64,329,783
S_FETCH cycles
7,643,195
7,615,856
S_MEM cycles
27,889,071
27,670,716
This is not a speedup claim for speculation. The P117 passing result is
guarded, so the small shell-window improvement is normal run-to-run and
initramfs-label movement, not evidence that the target buffer helped.
The real result is the bug boundary: speculative target data cannot use
the current prefetch/I-cache fill side effects until promotion and
discard are isolated from architectural instruction delivery.