sync: SHANGHAI-U9 2026-07-27 三个 Simulink→RTL skill 转系统级 + 新增 simulink-rtl-redev

- simulink_rtl_dev / rtl-ip-replace: 从工程级 .claude/skills 迁到用户级并去工程耦合
  (模型名/Notes 文档依赖/工程实测基线移出; addpath 与脚本路径改用户级)
- rtl-ip-replace/scripts/gen_cmp_tb.py: Vivado 路径不再写死, 改读 VIVADO_PATH /
  XILINX_VIVADO (兼容 install root / bin / bin\vivado.bat 三种写法), 回落时提示
  去设 skills_env.md 的 VIVADO_PATH
- simulink-rtl-redev: 新增。原生模型改动后的仿真模型同步规范, 含两个实测过的工具
  check_sync.py (三条时序链新鲜度闸门) 与 measure_k.m (时域/频域/包络三估计器互证)
- sim-rtl-flow/SKILL.md: 加入 sync_sim:* 步骤, 引用上述三个 skill

sim-rtl-flow/SKILL.md

@@ -94,12 +94,18 @@ From `Notes/PR01.md` and `Notes/PR01-2.md`; the graph routes on these.
    nativize all submodules in one Simulink model.
 3. **Never hand-edit MATLAB-generated RTL.** If IP replacement, Vivado timing, or HIL
    needs a change there, return `change_scope: "simulink_module"` + `affected_modules`.
-   The graph then forces a `modify_e:*` step — **edit the `-E.slx` and re-simulate
-   against sim-golden** — before any RTL is regenerated.
-4. **Timing fixes change the RTL, not the constraints.** Prefer adding pipeline/delay
+   The graph then forces `modify_e:* → sync_sim:*` before any RTL is regenerated.
+4. **Editing a `-E` model obliges you to sync the `-x`/`-q` model.** `modify_e:*` edits
+   only the `-E`; the follow-up `sync_sim:*` uses **`simulink-rtl-redev`** to carry the
+   same change into the simulation model and re-verify against sim-golden. The
+   derivation script does *not* translate native-core edits into the m implementation,
+   so changing one side alone means the RTL moved while the simulation still validates
+   the old behaviour. If they don't align, the graph goes back to `modify_e:*` — it will
+   **not** let you regenerate RTL.
+5. **Timing fixes change the RTL, not the constraints.** Prefer adding pipeline/delay
    stages. Only touch timing constraints when the constraint itself is plainly wrong,
    and say why in `notes`.
-5. **HIL is strictly read-only.** `hil:*` arrives with `allow_code_changes=false`. Run
+6. **HIL is strictly read-only.** `hil:*` arrives with `allow_code_changes=false`. Run
    `fpga-imx6-flow` / `zynq-imx6-flow` for *diagnosis only*; the moment a code change is
    needed, stop that sub-flow and report it back here — the fix happens in the
    sim-rtl-flow main graph, then re-enters Vivado and HIL.
@@ -183,9 +189,10 @@ keys with a default success — rehearsal only, and it refuses review keys.
 | `interfaces#n` | RTL↔SoC interface doc — register-config or data-stream only | write the doc under `work_dir` |
 | `review:functional_partition#n` | **ask the user** to sign off on the split + interfaces | — (relay to user) |
 | `module_plan#n` | split the RTL side into A/B/C…, give order + dependencies (**first pass only**) | inline |
-| `native:<M>#n` | nativize M into HDL-capable blocks, save `<project>_M-E.slx`, generate RTL | request says `simulink-rtl-dev` — **not installed**; use MATLAB MCP + model-based-design-core |
-| `ip_replace:<M>#n` | swap in Xilinx IP, cycle-true compare vs MATLAB RTL | request says `rtl-ip-replace` — **not installed**; use `vivado-sim` + `vivado-mcp` |
-| `modify_e:vivado#n` / `modify_e:hil#n` | **edit the named `-E.slx` and re-simulate** against sim-golden | MATLAB MCP + model-based-design-core |
+| `native:<M>#n` | nativize M into HDL-capable blocks, save `<project>_M-E.slx`, generate RTL | `simulink_rtl_dev` |
+| `ip_replace:<M>#n` | swap in Xilinx IP, cycle-true compare vs MATLAB RTL | `rtl-ip-replace` |
+| `modify_e:module#n` / `modify_e:vivado#n` / `modify_e:hil#n` | edit **only** the named `-E.slx` (cycle-true / timing / HIL driven) | `simulink_rtl_dev` |
+| `sync_sim:<source>#n` | carry that `-E` change into the matching `-x`/`-q` model and re-verify alignment | **`simulink-rtl-redev`** |
 | `vivado#n` | build the Vivado project, synth+impl+bitstream, check all timing | `vivado-prj-create`, `vivado-mcp` |
 | `hil:fpga-imx6-flow#n` / `hil:zynq-imx6-flow#n` | HIL debug, **read-only** | `fpga-imx6-flow` / `zynq-imx6-flow` |
 | `timing_rework#n` | fix non-Simulink RTL / SoC / project timing | inline |
@@ -215,12 +222,17 @@ review:   {"approved": true, "notes": "", "metadata": {}}
 
 Routing on `change_scope`:
 
-- `simulink_module` → **`modify_e:*`** (edit `-E.slx` + re-simulate) → only the affected
-  modules re-run `native → ip_replace` → Vivado → HIL.
+- `simulink_module` → **`modify_e:*`** (edit the `-E.slx`) → **`sync_sim:*`** (carry it
+  into `-x`/`-q`, re-verify) → only the affected modules re-run `native → ip_replace` →
+  Vivado → HIL.
 - `non_simulink_rtl` / `soc` / `hardware` → `timing_rework` (from Vivado) or `hil_rework`
   (from HIL) → Vivado.
 - The driver **rejects** `needs_code_change: true` with `change_scope: "none"`.
 
+A failing `ip_replace:<M>` (cycle-true mismatch) enters the same chain on its own:
+`evaluate_modules → modify_e:module → sync_sim:module → native:<M>`. A failing
+`native:<M>` does **not** — the `-E` isn't sound yet, so it just re-runs nativization.
+
 ### 6. Parallel batches (verified)
 
 | stage | keys handed over at once |
@@ -276,9 +288,14 @@ Global flags go **before** the subcommand: `--project`, `--work-dir`, `--thread-
   Mermaid can't show. Use `Notes/Result00.md` for the authoritative picture.
 - **`--max-attempts` must precede the subcommand** and stay the *same value* across
   `start` and every `resume` — it is runtime context, not persisted state.
-- **The two skills the graph names don't exist.** `native:*` suggests `simulink-rtl-dev`,
-  `ip_replace:*` suggests `rtl-ip-replace`; neither is installed. Fall back to the MATLAB
-  MCP + `model-based-design-core:*` skills and `vivado-sim` / `vivado-mcp`. Don't abort.
+- **The skill names the graph hands you are real and exact** — `simulink_rtl_dev`
+  (**underscores**, not dashes), `rtl-ip-replace`, `simulink-rtl-redev`. All three are
+  installed. Invoke the named one rather than improvising with MATLAB MCP directly: they
+  carry the project's own gates (`audit_hdl_blocks.m`, cycle-true compare, `check_sync.py`).
+- **`sync_sim:*` is not optional bookkeeping.** It is the step that keeps the `-x`/`-q`
+  model telling the truth about the `-E` you just changed. Recording it as passed without
+  actually re-simulating means every later gate — Vivado, HIL, sim-golden — is validating
+  a model that no longer matches the RTL.
 - **`simulink_x`'s first artifact silently becomes sim-golden.** Record `artifacts: []`
   and the graph substitutes `<project_name>-x.slx`. Always record the real filename.
 - **`module_plan` runs only on the first pass.** Rework rounds reuse the plan, so you