fix(pre-bringup): second-batch P1/P2/P3 audit findings

Addresses the remaining actionable items from
docs/DEVELOP_AUDIT_2026-04-19.md after commit 3f47d1e.

XDC (dead waivers — F-0.4, F-0.5, F-0.6, F-0.7):
- ft_clkout_IBUF CLOCK_DEDICATED_ROUTE now uses hierarchical filter;
  flat net name did not exist post-synth.
- reset_sync_reg[*] false-path rewritten to walk hierarchy and filter
  on CLR/PRE pins.
- adc_clk_mmcm.xdc ft601_clk_in references replaced with foreach-loop
  over real USB clock names, gated on -quiet existence.
- MMCM LOCKED waiver uses REF_PIN_NAME filter instead of the
  previously-missing u_core/ literal path.

CDC (F-1.1, F-1.2, F-1.3):
- Documented the quasi-static-bus stability invariant above the
  FT601 cmd_valid toggle block.
- cdc_adc_to_processing gains an `overrun` output; the two CIC->FIR
  instances feed a sticky cdc_cic_fir_overrun flag surfaced on
  gpio_dig5 so silent sample drops become visible to the MCU.
- Removed the dead mixers_enable synchronizer in ddc_400m.v; the _sync
  output was unused and every caller ties the port to 1'b1.

Diagnostics (F-6.4):
- range_bin_decimator watchdog_timeout plumbed through receiver
  and top-level, OR'd into gpio_dig5.

ADAR (F-4.7):
- delayUs() replaced with DWT cycle counter; self-initialising
  TRCENA/CYCCNTENA, overflow-safe unsigned subtraction.

Regression: tb_cdc_modules.v 57/57 passes under iverilog after
the cdc_modules.v change. Remote Vivado verification in progress.

9_Firmware/9_2_FPGA/constraints/adc_clk_mmcm.xdc

@@ -47,8 +47,16 @@ set_max_delay -datapath_only -from [get_clocks clk_mmcm_out0] \
 set_false_path -from [get_clocks clk_100m] -to [get_clocks clk_mmcm_out0]
 set_false_path -from [get_clocks clk_mmcm_out0] -to [get_clocks clk_100m]
 
-set_false_path -from [get_clocks clk_mmcm_out0] -to [get_clocks ft601_clk_in]
-set_false_path -from [get_clocks ft601_clk_in] -to [get_clocks clk_mmcm_out0]
+# Audit F-0.6: the clock name `ft601_clk_in` does not exist on either 50T
+# (FT2232H, clock is `ft_clkout`) or 200T builds in the current RTL. Waive
+# against whichever USB-domain clock is actually defined in the build.
+foreach _usb_clk {ft_clkout ft601_clk ft601_clk_in} {
+    if {[llength [get_clocks -quiet $_usb_clk]] > 0} {
+        set_false_path -from [get_clocks clk_mmcm_out0] -to [get_clocks $_usb_clk]
+        set_false_path -from [get_clocks $_usb_clk] -to [get_clocks clk_mmcm_out0]
+    }
+}
+unset _usb_clk
 
 set_false_path -from [get_clocks clk_mmcm_out0] -to [get_clocks clk_120m_dac]
 set_false_path -from [get_clocks clk_120m_dac] -to [get_clocks clk_mmcm_out0]
@@ -59,7 +67,10 @@ set_false_path -from [get_clocks clk_120m_dac] -to [get_clocks clk_mmcm_out0]
 # LOCKED is not a valid timing startpoint (it's a combinational output of the
 # MMCM primitive). Use -through instead of -from to waive all paths that pass
 # through the LOCKED net. This avoids the CRITICAL WARNING from Build 19/20.
-set_false_path -through [get_pins rx_inst/adc/mmcm_inst/mmcm_adc_400m/LOCKED]
+# Audit F-0.7: the literal hierarchical path was missing the `u_core/`
+# prefix and silently matched no pins. Use a hierarchical wildcard to
+# catch the MMCM LOCKED pin regardless of wrapper hierarchy.
+set_false_path -through [get_pins -hierarchical -filter {REF_PIN_NAME == LOCKED}]
 
 # --------------------------------------------------------------------------
 # Hold waiver for source-synchronous ADC capture (BUFIO-clocked IDDR)

9_Firmware/9_2_FPGA/constraints/xc7a50t_ftg256.xdc

@@ -107,8 +107,15 @@ set_property PACKAGE_PIN C4 [get_ports {ft_clkout}]
 set_property IOSTANDARD LVCMOS33 [get_ports {ft_clkout}]
 create_clock -name ft_clkout -period 16.667 [get_ports {ft_clkout}]
 set_input_jitter [get_clocks ft_clkout] 0.2
-# N-type MRCC pin requires dedicated route override (Place 30-876)
-set_property CLOCK_DEDICATED_ROUTE FALSE [get_nets {ft_clkout_IBUF}]
+# N-type MRCC pin requires dedicated route override (Place 30-876).
+# Audit F-0.4: the literal net name `ft_clkout_IBUF` exists post-synth but
+# the XDC scan happens before synthesis, when the IBUF net does not yet
+# exist — Vivado reported `No nets matched 'ft_clkout_IBUF'` + CRITICAL
+# WARNING. Use -hierarchical -filter + -quiet so the constraint matches
+# post-synth without warning during pre-synth XDC scan. The TCL duplicate
+# at scripts/50t/build_50t.tcl:119 remains as belt-and-suspenders.
+set_property -quiet CLOCK_DEDICATED_ROUTE FALSE \
+    [get_nets -quiet -hierarchical -filter {NAME =~ *ft_clkout_IBUF}]
 
 # ============================================================================
 # RESET (Active-Low)
@@ -408,7 +415,17 @@ set_false_path -from [get_ports {stm32_mixers_enable}]
 #   - Reset deassertion order is not functionally critical — all registers
 #     come out of reset within a few cycles of each other
 # --------------------------------------------------------------------------
-set_false_path -from [get_cells reset_sync_reg[*]] -to [get_pins -filter {REF_PIN_NAME == CLR} -of_objects [get_cells -hierarchical -filter {PRIMITIVE_TYPE =~ REGISTER.*.*}]]
+# Audit F-0.5: the literal cell name `reset_sync_reg[*]` does not match any
+# cell in the post-synth netlist. The actual sync regs are
+# `u_core/reset_sync_reg[0..1]`, `u_core/rx_inst/ddc/reset_sync_400m_reg[*]`,
+# `u_core/gen_ft2232h.usb_inst/ft_reset_sync_reg[*]`, and peers under
+# `u_core/reset_sync_120m_reg[*]`, `u_core/reset_sync_ft601_reg[*]`,
+# `u_core/rx_inst/adc/reset_sync_400m_reg[*]`. The waiver below covers all
+# of them by matching any register whose name contains `reset_sync`.
+# Without this, STA runs recovery/removal on the fanout of each sync-chain
+# output register (up to ~1000 loads pre-PR#113 replication).
+set_false_path -from [get_cells -hierarchical -filter {NAME =~ *reset_sync*_reg*}] \
+               -to   [get_pins  -hierarchical -filter {REF_PIN_NAME == CLR || REF_PIN_NAME == PRE}]
 
 # --------------------------------------------------------------------------
 # Clock Domain Crossing false paths