doc: describe the ARM7 memory-read operating context

The ARM7TDMI memory read (cpu_read/cpu_halt/cpu_resume) works; document
when and how:
- tutorial: rewrite the "CPU targets" section from "structure only" to a
  working cpu_read walkthrough (dump LPC2103 flash to Intel HEX), state
  the operating envelope (power-on -> one halt -> dump; reads clobber
  r0..r14/PC, no context save/restore, so resume isn't clean and a
  re-halt in the same session can time out -> power-cycle), plus a
  troubleshooting row for the sys-speed timeout.
- CLAUDE.md: roadmap phase 7 + ARM-debug note now say the read works
  (flash dump validated), with context save/restore + arm_flash write as
  the remaining steps.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CLAUDE.md

@@ -45,7 +45,7 @@ src/
     ├── svf/               SVF player (svf_play): SIR/SDR/RUNTEST/STATE, masked compare
     ├── probes/            Probe-config profiles loader (parses data/probes.yaml, libyaml)
     ├── program/           `program` dispatch: routes a target to its backend by `prog`
-    └── arm_debug/         ARM (EmbeddedICE) debug + flash backend (not implemented yet)
+    └── arm_debug/         ARM7TDMI (EmbeddedICE) debug: halt/resume, Thumb->ARM, memory read (works); flash-write backend TODO
 data/                      — runtime resources, looked up CWD-relative —
 ├── targets.yaml           Target registry (FPGAs + CPUs: IDCODE, BSDL/proxy, debug, flash, prog)
 ├── probes.yaml            Probe-config profiles (defaults + per-probe overrides)
@@ -72,7 +72,7 @@ Adding a feature usually means adding a new script command in
 | 4 | script commands | **done** (commit `d6f843e`) | `flash_detect`, `flash_read` (+file), `flash_erase`, `flash_write`, `flash_verify`. Full set validated on KCU105 (save/erase/write-random/verify/restore round-trip). ~100 KB/s write once the proxy is loaded. |
 | 5 | `probes/` + JTAG-link | **done** | `data/probes.yaml` probe-config profiles (`jtag_open <idx> <profile>`, `jtag_profiles`, `jtag_close`); driver-neutral `JTAG_TCK_FREQ_KHZ`/`JTAG_RTCK`; device `max_tck_khz` clock cap resolved at `jtag_autoinit`; `prog` method tag. See the config-strategy design note. Validated on the IGLOO2 (FlashPro). |
 | 6 | `svf/` | **done** (subset, commit `c77d86e`) | SVF player + `svf_play`: SIR/SDR with masked TDO compare, RUNTEST, STATE — single-device. Validated on the IGLOO2 IDCODE. |
-| 7 | `target/` + `program/` + `arm_debug/` | **structure done; ARM impl TODO** | Generalized `fpga/` into a kind-aware `target/` registry (FPGA \| CPU). `program <dev> <file>` dispatches by `prog` (svf wired; proxy_spi points at the flash workflow). `arm_debug/` (EmbeddedICE) + `arm_flash` backend are declared but not implemented; `arm-usb-ocd` probe profile added. FPGA path re-validated on the IGLOO2. See the ARM-debug design note. |
+| 7 | `target/` + `program/` + `arm_debug/` | **structure done; ARM read works, flash-write TODO** | Generalized `fpga/` into a kind-aware `target/` registry (FPGA \| CPU). `program <dev> <file>` dispatches by `prog` (svf wired; proxy_spi points at the flash workflow). `arm_debug/` (ARM7TDMI EmbeddedICE) does halt/resume, Thumb->ARM, and system-speed **memory read** — `cpu_read`/`cpu_halt`/`cpu_resume`; validated by dumping an LPC2103's 32 KB flash to Intel HEX. Context save/restore + the `arm_flash` write backend are TODO. `arm-usb-ocd` probe profile added. See the ARM-debug design note. |
 
 | 8 | FTDI driver → libftdi1 | **done** | Replaced the proprietary libftd2xx with open-source libftdi1 (libusb): any VID:PID + auto kernel-detach. Detected an NXP LPC2103 (ARM7TDMI-S, IDCODE 0x4F1F0F0F) over an Olimex ARM-USB-OCD — the probe the old lib couldn't enumerate. Vendored `src/libs/libftd2xx` removed. |
 
@@ -318,8 +318,12 @@ tool.
 
 ## Programming CPUs over JTAG: ARM7/9 via EmbeddedICE (design note)
 
-Structure in place (`target/` kind=cpu, `program/` dispatch, `arm_debug/`
-+ `arm_flash` declared); the debug/flash code is the next real work.
+Memory **read works** (`cpu_read`/`cpu_halt`/`cpu_resume` on ARM7TDMI
+EmbeddedICE): halt, Thumb->ARM switch, system-speed `LDMIA` read, dumped
+to bin/Intel HEX — validated by an LPC2103 32 KB flash dump. Context
+save/restore (for clean resume + repeated reads) and the `arm_flash`
+write backend are the remaining work. See "What's left" and the
+arm7-debug-dclk-timing note in `~/.claude/` for the cycle-exact timing.
 
 ### Why CPUs are a different shape
 
@@ -358,9 +362,14 @@ filling from the Olimex schematic / OpenOCD's interface config.
 
 ### What's left (the implementation)
 
-EmbeddedICE scan-chain access + halt/resume + memory R/W, then a per-MCU
-RAM flash loader (LPC2xxx, AT91SAM7, …) and the `arm_flash` backend. The
-registry, dispatch, probe-profile and config layers are ready for it.
+Done: EmbeddedICE scan-chain access, halt/resume, Thumb->ARM, debug-speed
+register read/write, and system-speed **memory read** (`cpu_read`).
+Reliable in a power-on → one-halt → dump flow; reads clobber r0..r14/PC
+with no context save/restore, so resume isn't clean and repeated halts in
+one session degrade (power-cycle between dumps). Left: register **context
+save/restore** (clean resume + repeated reads), then a per-MCU RAM flash
+loader (LPC2xxx, AT91SAM7, …) and the `arm_flash` write backend. The
+registry, dispatch, probe-profile and config layers are ready.
 
 ## Embedded port (design note)