docs: address Codex/Copilot review on #3786

- target-debug: fault frame lives on PSP when EXC_RETURN bit2 set (FreeRTOS
  tasks) — decode LR before choosing $msp/$psp (Codex; valid, our verify
  happened to fault on MSP)
- esp-target-debug: show the Xtensa gdb for S3 in the attach recipe; clarify
  adapter serial = USB-SJ iSerial (colon MAC, hardware-verified) vs the
  CP2102N flasher uids in tinyusb.json (Codex; second half of the finding
  had the identifiers inverted)
- esp plan: align serial form with the verified command; record the real
  console-gate outcome (UART0, USB-SJ console untested) (Copilot)
- target-debug plan: Task 4 now consistently $JB/ARMv7-M matching the
  executed JLinkExe path (Copilot)
- drop IDE-local .idea files swept in by the rename commit (Copilot)

11 files changed, 19 insertions, 52 deletions

diff --git a/.claude/skills/esp-target-debug/SKILL.md b/.claude/skills/esp-target-debug/SKILL.md
index c6d76c801..1af9fcf7f 100644
--- a/.claude/skills/esp-target-debug/SKILL.md
+++ b/.claude/skills/esp-target-debug/SKILL.md
@@ -53,10 +53,14 @@ openocd -c 'set ESP_RTOS FreeRTOS' -f board/esp32p4-builtin.cfg \
         -c 'adapter serial <MAC-with-colons>' &        # S3: board/esp32s3-builtin.cfg
 riscv32-esp-elf-gdb -batch -ex 'target extended-remote :3333' \
   -ex 'tbreak tud_task_ext' -ex continue -ex bt -ex 'info threads' -ex detach <elf>
+# S3 is Xtensa: use xtensa-esp32s3-elf-gdb with the same arguments
 ```
 
-- `adapter serial` = the chip MAC **with colons** (`lsusb -v -d 303a:1001`, or
-  `/dev/serial/by-id/usb-Espressif_USB_JTAG_serial_debug_unit_<MAC>-if00`).
+- `adapter serial` = the chip MAC **with colons** — the USB-SJ device's
+  iSerial exactly as `lsusb -v -d 303a:1001` or
+  `/dev/serial/by-id/usb-Espressif_USB_JTAG_serial_debug_unit_<MAC>-if00`
+  prints it. (The `tinyusb.json` esptool uids are the CP2102N *flasher*
+  serials — a different port; never pass those to openocd.)
 - `set ESP_RTOS FreeRTOS` must precede the board cfg: with it, `info threads`
   lists every task with name/state/CPU (verified: usbd Running @CPU0, IDLE1
   @CPU1, ...); without it, one bare "Remote target".
diff --git a/.claude/skills/target-debug/SKILL.md b/.claude/skills/target-debug/SKILL.md
index ab754dc09..1dc55440f 100644
--- a/.claude/skills/target-debug/SKILL.md
+++ b/.claude/skills/target-debug/SKILL.md
@@ -172,6 +172,8 @@ p/x *(unsigned*)0xE000ED28   # CFSR — low byte MemManage, byte1 BusFault, top
 p/x *(unsigned*)0xE000ED2C   # HFSR — bit30 FORCED = an escalated lower-priority fault
 p/x *(unsigned*)0xE000ED38   # BFAR — faulting address (valid if CFSR bit15 BFARVALID)
 x/8wx $msp                   # stacked frame: r0 r1 r2 r3 r12 lr pc xpsr — pc = culprit
+# frame is on PSP when EXC_RETURN bit2 is set (LR = 0xFFFFFFFD — FreeRTOS
+# tasks run on PSP): then x/8wx $psp instead. LR 0xFFFFFFF1/E9 = MSP.
 ```
 
 `addr2line -e <elf> <stacked pc>` names the line (verified: CFSR 0x8200,
diff --git a/.idea/codeStyles/Project.xml b/.idea/codeStyles/Project.xml
deleted file mode 100644
index 35c56fc87..000000000
--- a/.idea/codeStyles/Project.xml
+++ /dev/null
@@ -1,10 +0,0 @@
-<component name="ProjectCodeStyleConfiguration">
-  <code_scheme name="Project" version="173">
-    <RiderCodeStyleSettings>
-      <option name="/Default/CodeStyle/CodeFormatting/CppClangFormat/EnableClangFormatSupport/@EntryValue" value="true" type="bool" />
-    </RiderCodeStyleSettings>
-    <clangFormatSettings>
-      <option name="ENABLED" value="true" />
-    </clangFormatSettings>
-  </code_scheme>
-</component>
\ No newline at end of file
diff --git a/.idea/codeStyles/codeStyleConfig.xml b/.idea/codeStyles/codeStyleConfig.xml
deleted file mode 100644
index 79ee123c2..000000000
--- a/.idea/codeStyles/codeStyleConfig.xml
+++ /dev/null
@@ -1,5 +0,0 @@
-<component name="ProjectCodeStyleConfiguration">
-  <state>
-    <option name="USE_PER_PROJECT_SETTINGS" value="true" />
-  </state>
-</component>
\ No newline at end of file
diff --git a/.idea/improve-debug-skill-agent.iml b/.idea/improve-debug-skill-agent.iml
deleted file mode 100644
index 4c9423543..000000000
--- a/.idea/improve-debug-skill-agent.iml
+++ /dev/null
@@ -1,2 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module classpath="CIDR" type="CPP_MODULE" version="4" />
\ No newline at end of file
diff --git a/.idea/inspectionProfiles/Project_Default.xml b/.idea/inspectionProfiles/Project_Default.xml
deleted file mode 100644
index 6b55c5c28..000000000
--- a/.idea/inspectionProfiles/Project_Default.xml
+++ /dev/null
@@ -1,17 +0,0 @@
-<component name="InspectionProjectProfileManager">
-  <profile version="1.0">
-    <option name="myName" value="Project Default" />
-    <inspection_tool class="CppAbstractVirtualFunctionCallInCtor" enabled="true" level="ERROR" enabled_by_default="true" />
-    <inspection_tool class="CppAccessSpecifierWithNoDeclarations" enabled="true" level="WEAK WARNING" enabled_by_default="true" />
-    <inspection_tool class="CppDFANullDereference" enabled="false" level="WARNING" enabled_by_default="false" />
-    <inspection_tool class="CppDFATimeOver" enabled="false" level="WARNING" enabled_by_default="false" />
-    <inspection_tool class="CppEnforceForStatementBraces" enabled="false" level="WARNING" enabled_by_default="false" />
-    <inspection_tool class="CppFunctionIsNotImplemented" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="CppIdenticalOperandsInBinaryExpression" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="CppPossiblyUninitializedMember" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="CppRedundantMemberInitializer" enabled="true" level="WEAK WARNING" enabled_by_default="true" />
-    <inspection_tool class="CppSmartPointerVsMakeFunction" enabled="true" level="WEAK WARNING" enabled_by_default="true" />
-    <inspection_tool class="CppSomeObjectMembersMightNotBeInitialized" enabled="true" level="WARNING" enabled_by_default="true" />
-    <inspection_tool class="CppUninitializedDependentBaseClass" enabled="true" level="WARNING" enabled_by_default="true" />
-  </profile>
-</component>
\ No newline at end of file
diff --git a/.idea/misc.xml b/.idea/misc.xml
index 7ed4f1ab9..f0fcd6912 100644
--- a/.idea/misc.xml
+++ b/.idea/misc.xml
@@ -1,5 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
+  <component name="CMakePythonSetting">
+    <option name="pythonIntegrationState" value="YES" />
+  </component>
   <component name="CMakeWorkspace" PROJECT_DIR="$PROJECT_DIR$/examples">
     <contentRoot DIR="$PROJECT_DIR$" />
   </component>
@@ -8,4 +11,4 @@
       <file path="$PROJECT_DIR$/hw/mcu" />
     </excludeRoots>
   </component>
-</project>
+</project>
\ No newline at end of file
diff --git a/.idea/modules.xml b/.idea/modules.xml
deleted file mode 100644
index e97c64966..000000000
--- a/.idea/modules.xml
+++ /dev/null
@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="ProjectModuleManager">
-    <modules>
-      <module fileurl="file://$PROJECT_DIR$/.idea/improve-debug-skill-agent.iml" filepath="$PROJECT_DIR$/.idea/improve-debug-skill-agent.iml" />
-    </modules>
-  </component>
-</project>
\ No newline at end of file
diff --git a/.idea/vcs.xml b/.idea/vcs.xml
index d44b5516f..94a25f7f4 100644
--- a/.idea/vcs.xml
+++ b/.idea/vcs.xml
@@ -2,6 +2,5 @@
 <project version="4">
   <component name="VcsDirectoryMappings">
     <mapping directory="$PROJECT_DIR$" vcs="Git" />
-    <mapping directory="$PROJECT_DIR$/hw/mcu/raspberry_pi/Pico-PIO-USB" vcs="Git" />
   </component>
 </project>
\ No newline at end of file
diff --git a/docs/superpowers/plans/2026-07-23-esp-target-debug-skill.md b/docs/superpowers/plans/2026-07-23-esp-target-debug-skill.md
index 8b470eb74..d08902111 100644
--- a/docs/superpowers/plans/2026-07-23-esp-target-debug-skill.md
+++ b/docs/superpowers/plans/2026-07-23-esp-target-debug-skill.md
@@ -41,7 +41,7 @@ lsusb | grep -i cafe   # TinyUSB VID on the DUT port
 - [x] **Step 3: Attach openocd over USB-SJ while the device runs**
 
 ```bash
-openocd -f board/esp32p4-builtin.cfg -c 'adapter serial 6055F9F98715' &   # gdb :3333
+openocd -f board/esp32p4-builtin.cfg -c 'adapter serial 60:55:F9:F9:87:15' &   # gdb :3333 — USB-SJ iSerial = MAC with colons
 riscv32-esp-elf-gdb -batch -ex 'target extended-remote :3333' -ex 'monitor halt' \
   -ex bt -ex 'monitor resume' <p4 elf>
 ```
@@ -53,7 +53,7 @@ Expected: backtrace with symbols; after resume the CDC device still answers (re-
 
 - [x] **Step 1: Breakpoint/watchpoint budget** — RISC-V trigger count: in gdb `monitor riscv info` or set watchpoints until rejection; verify a hardware watchpoint on a TinyUSB variable (e.g. `watch -l` on a usbd counter) reports and hits.
 - [x] **Step 2: FreeRTOS threads** — `info threads` after halt; expect ESP-IDF tasks incl. the USB task; note whether it works at attach or needs run→stop (mirror the ARM finding).
-- [x] **Step 3: Console during traffic** — capture the USB-SJ console tty (the 303a:1001 CDC function) for a few seconds while DUT traffic runs; expect ESP-IDF log lines. Record the /dev node mapping by serial.
+- [x] **Step 3: Console during traffic** — OUTCOME: stock builds route the console to UART0 (the CP2102 flasher tty — boot log captured there); the USB-SJ CDC carries no log without sdkconfig `ESP_CONSOLE_USB_SERIAL_JTAG`, which stays (untested) in the skill.
 - [x] **Step 4: Reflash pristine, release P4 lock.** Evidence appended to `/tmp/esp_evidence.txt`.
 
 ### Task 3: P4 apptrace spike — GATED (spec gate 5)
diff --git a/docs/superpowers/plans/2026-07-23-target-debug-skill-enhancement.md b/docs/superpowers/plans/2026-07-23-target-debug-skill-enhancement.md
index edace21c7..36a3144c2 100644
--- a/docs/superpowers/plans/2026-07-23-target-debug-skill-enhancement.md
+++ b/docs/superpowers/plans/2026-07-23-target-debug-skill-enhancement.md
@@ -313,8 +313,8 @@ board back; RISC-V ports have no DEMCR — use a breakpoint on the trap handler.
 Create the fault build (NOT committed):
 
 ```bash
-python3 test/hil/board_lock.py hold $OB --reason "skill-enhance verify: vector catch"
-cd examples/device/cdc_msc
+python3 test/hil/board_lock.py hold $JB --reason "skill-enhance verify: vector catch"
+cd examples/device/cdc_msc   # executed on $JB (stm32f407disco, ARMv7-M) via JLinkExe — see commit evidence
 # temporary patch — revert after: fault 5 s after boot
 python3 - <<'EOF'
 import pathlib
@@ -327,12 +327,13 @@ s = s.replace('led_blinking_task();', 'led_blinking_task(); _fault_after_5s();',
 p.write_text(s)
 EOF
 grep -n '_fault_after_5s' src/main.c   # expect 3 hits: definition + call + (none in decl block)
-cmake -B build-fault -DBOARD=$OB -G Ninja -DCMAKE_BUILD_TYPE=MinSizeRel && cmake --build build-fault
+cmake -B build-fault -DBOARD=$JB -G Ninja -DCMAKE_BUILD_TYPE=MinSizeRel && cmake --build build-fault
 ```
 (If `app_led_task`/`board_millis` anchors differ in the current `main.c`, place the same 3-line helper on whatever per-loop task function exists — the fault line `*(volatile uint32_t*)0xCF000000u = 0;` is the payload.)
 Flash `build-fault`, then:
 
 ```bash
+# executed variant: DEMCR armed + autopsy via JLinkExe command file on $JB (see commit c1d2d305f evidence); OpenOCD-native form:
 openocd $OPENOCD_OPTION -c init -c 'cortex_m vector_catch hard_err bus_err' &
 timeout 60 arm-none-eabi-gdb -batch -ex 'target remote :3333' -ex 'monitor reset run' \
   -ex 'shell sleep 8' -ex 'interrupt' \
@@ -343,7 +344,7 @@ Expected: halted in the fault path, CFSR BusFault bits set, **BFAR = 0xCF000000*
 
 - [x] **Step 3: Clean up hardware state**
 
-`git checkout -- src/main.c`, delete `build-fault/`, clear DEMCR bits (`set *(unsigned*)0xE000EDFC &= ~0x7F1` via a final gdb attach or power-cycle note), reflash pristine cdc_msc, `board_lock.py release $OB`.
+`git checkout -- src/main.c`, delete `build-fault/`, clear DEMCR bits (`set *(unsigned*)0xE000EDFC &= ~0x7F1` via a final gdb attach or power-cycle note), reflash pristine cdc_msc, `board_lock.py release $JB`.
 
 - [x] **Step 4: Commit**