sysview: bench-run the WCH post-mortem dump recipe on ch32v307v_r1_1v0

The recipe was committed syntax-checked only. Run as written (cdc_msc, since
neither WCH family builds the FreeRTOS examples): halt-only attach, 4096-byte
ring dumped and WrOff-split, decoded to a 0.16 s window with overflow 0,
ISR 85 n=68 p50 5.0 us, tud_task n=69 p50 8.0 / p99 17.0 us. ch582m is out of
this recipe's scope - its ring does not survive OpenOCD's attach-reset.
diff --git a/.claude/skills/sysview/SKILL.md b/.claude/skills/sysview/SKILL.md
index a3581b6..832429a 100644
--- a/.claude/skills/sysview/SKILL.md
+++ b/.claude/skills/sysview/SKILL.md
@@ -185,13 +185,16 @@
 `boards.md` has `JLINK_DEVICE` `—`, so on `ch32v20x`/`ch32v30x` the dump is
 hand-driven over OpenOCD: one attach reads the same channel-1 ring descriptor
 and dumps the same bytes, and the WrOff split below is the script's
-linearization verbatim. `ch32v10x` and `ch583` reset on every WCH-Link attach,
-which wipes the ring — no dump route there either (`boards.md`). Build with the
-same `cmake` lines as above (there is no `-jlink` flash target here); `<uid>` is
-the board's `flasher.uid` in `test/hil/tinyusb.json`.
+linearization verbatim. `ch32v10x` resets on every WCH-Link attach and ch582m's
+ring does not survive OpenOCD's attach-reset (`boards.md`), so this recipe is
+for `ch32v20x`/`ch32v30x` only. Neither family builds the FreeRTOS examples, so
+the post-mortem image is `cdc_msc`; `<uid>` is the board's `flasher.uid` in
+`test/hil/tinyusb.json`.
 
 ```bash
-ELF=build-pm/cdc_msc_freertos.elf
+cmake -B build-pm -DBOARD=<board> -G Ninja -DCMAKE_BUILD_TYPE=MinSizeRel \
+  -DSYSVIEW=4 -DSYSVIEW_POST_MORTEM=1 examples/device/cdc_msc && cmake --build build-pm
+ELF=build-pm/cdc_msc.elf
 OUT=/tmp/sysview-pm; mkdir -p $OUT
 OOCD=(openocd -c "tcl_port disabled" -c "gdb_port disabled" -c "telnet_port disabled"
       -c "adapter serial <uid>" -c "adapter usb vid_pid 0x1a86 0x8010"
@@ -227,10 +230,10 @@
 ```
 
 The core is left halted; recover the board by reflashing pristine firmware —
-`reset run` under SDI never comes back. **Not bench-run yet**: the OpenOCD/Tcl
-and the split are syntax-checked against openocd 0.12.0+dev and against
-`sysview_dump.py`'s linearization, but no WCH post-mortem has been captured on
-the rig.
+`reset run` under SDI never comes back. Bench-run as written on
+`ch32v307v_r1_1v0` (2026-09-04, openocd 0.12.0+dev-02620): a 4096-byte ring
+halted mid-CDC-burst decoded to a 0.16 s window, overflow 0, ISR 85 n=68
+p50 5.0 µs, `tud_task` n=69 p50 8.0 / p99 17.0 µs.
 
 ## Build options
 
diff --git a/.claude/skills/sysview/boards.md b/.claude/skills/sysview/boards.md
index 690e880..9bc1dfc 100644
--- a/.claude/skills/sysview/boards.md
+++ b/.claude/skills/sysview/boards.md
@@ -52,7 +52,7 @@
 | raspberry_pi_pico2       | rp2040     | rp2350_m33_0      | DWT              | validated — see caveat | OpenOCD |        | —      | —     | —                | —                   |
 | same54_xplained          | samd5x_e5x | ATSAME54P20       | DWT              | validated end-to-end   | J-Link  |        | —      | —     | —                | — (prose below)     |
 | mimxrt1064_evk           | imxrt      | MIMXRT1064xxx6A   | DWT              | validated (dual)       | J-Link  | 65536  | —      | —     | —                | —                   |
-| ch32v307v_r1_1v0         | ch32v30x   | —                 | QingKe SysTick   | tick 996.1 Hz (−0.39%) | dump    |        | —      | —     | —                | —                   |
+| ch32v307v_r1_1v0         | ch32v30x   | —                 | QingKe SysTick   | tick 996.1 Hz (−0.39%) | dump    | 4096   | 0.16 s | 0     | 85, 5.0          | 8.0 / 17.0          |
 | ch582m_evt               | ch583      | —                 | QingKe SysTick   | tick 997.2 Hz (−0.28%) | dump    | 2048   | —      | —     | —                | —                   |
 | nanoch32v203             | ch32v20x   | —                 | QingKe SysTick   | tick 838.6 Hz (−16.1%) | dump    | 2048   | —      | —     | —                | —                   |
 
@@ -64,7 +64,9 @@
 `ci.lan:~/sysview-v2/out/campaign-final/`); the rate column keeps each board's
 original measurement, some of which predate the route switch. `—` capture
 cells: the board was not in the campaign (J-Link-only validations, host-role
-pico2, dump-route WCH). Reading the overflow column: zero on 65536 with a fast
+pico2, dump-route WCH — ch32v307's cells are its 2026-09-04 post-mortem dump,
+a 4096-byte ring halted mid-burst, hence the 0.16 s window). Reading the
+overflow column: zero on 65536 with a fast
 probe path; small-buffer boards (2048/4096) drop by design; f723/fruit_jam/
 feather lose on drain-path throughput (drain-rate caveat below). metro's short
 window is the attach_only mid-stream join (2.4–5.6 s across runs).