risc-v-gsp-rm-debugger: B5 two-task attach + aggregate-state decode + docs 51/53 status

- sim/libos_port.py: port-role model + two-task network (extintr handoff,
  cross-task send/reply, TASK_STATE_QUERY trap state)
- sim/msgq_attach.py: image task discovery, bounded two-task schedule,
  second-task-frontier divergence fields (first ring poll still blocked on
  post-init resume + GSP_ARGUMENTS_CACHED handoff; no fabricated polls)
- harness/state_decode.py: aggregate 'group: key=value' state parsing
  (20-gsp-phys-state-* dumps) + kv diff classification
- tests: 127 green across the five observability modules
- docs/51/53: status and changelog updates

1 files changed, 15 insertions, 0 deletions

diff --git a/debug/risc-v-gsp-rm-vm/docs/51-HOST-TRAFFIC-LOOP.md b/debug/risc-v-gsp-rm-vm/docs/51-HOST-TRAFFIC-LOOP.md
index e56094c..30c2804 100644
--- a/debug/risc-v-gsp-rm-vm/docs/51-HOST-TRAFFIC-LOOP.md
+++ b/debug/risc-v-gsp-rm-vm/docs/51-HOST-TRAFFIC-LOOP.md
@@ -229,6 +229,21 @@ Next step for B5, concretely (each point is bounded and session-recorded):
 5. Then replay one captured stimulus message with the real image and record
    the reply/writes as the B5 session. Until a supervised capture exists,
    this stops at step 3–4 with the stub dispatcher.
+6. **Two-task wave (landed 2026-10-06).** `sim/msgq_attach.py` now discovers
+   the image's linked tasks from its own section/manifest records and
+   schedules the second one (the RM task) when the init task blocks:
+   `sim.libos_port.LibosPortNetwork` routes sends/receives/replies between
+   the modelled tasks with the firmware's own payload bytes, serves
+   `TASK_STATE_QUERY` with a modelled spurious/EINT trap state, and fixes the
+   synchronous receive semantics (a receive with a non-zero wait id blocks
+   instead of completing). Measured frontier: the RM task completes the boot
+   port handshake and then runs its own start-up past the 2M instruction cap
+   before its first further port syscall, so **no ring poll is reachable from
+   its entry inside the cap**; the report names the exact next semantics
+   (`missing_semantic.stage = second-task-frontier`): a data-driven post-init
+   resume point, the `GSP_ARGUMENTS_CACHED`/queue-init address handoff, and
+   the doorbell→consumer interrupt binding. Single-task behaviour is kept
+   with `--no-second-task` (and the old `task-state-query` classification).
 
 The seam for step 3 already exists: `HostTraffic(machine=..., shared_base=...)`
 uses the machine's RAM for the rings and `run_cycles` steps the core; the