risc-v-gsp-rm-debugger: B5 two-task attach + aggregate-state decode + docs 51/53 status

- sim/libos_port.py: port-role model + two-task network (extintr handoff,
  cross-task send/reply, TASK_STATE_QUERY trap state)
- sim/msgq_attach.py: image task discovery, bounded two-task schedule,
  second-task-frontier divergence fields (first ring poll still blocked on
  post-init resume + GSP_ARGUMENTS_CACHED handoff; no fabricated polls)
- harness/state_decode.py: aggregate 'group: key=value' state parsing
  (20-gsp-phys-state-* dumps) + kv diff classification
- tests: 127 green across the five observability modules
- docs/51/53: status and changelog updates

1 files changed, 15 insertions, 7 deletions

diff --git a/debug/risc-v-gsp-rm-vm/docs/53-FIRMWARE-OBSERVABILITY-WORKFLOW.md b/debug/risc-v-gsp-rm-vm/docs/53-FIRMWARE-OBSERVABILITY-WORKFLOW.md
index 4106244..336f1b6 100644
--- a/debug/risc-v-gsp-rm-vm/docs/53-FIRMWARE-OBSERVABILITY-WORKFLOW.md
+++ b/debug/risc-v-gsp-rm-vm/docs/53-FIRMWARE-OBSERVABILITY-WORKFLOW.md
@@ -119,14 +119,21 @@ python3 -m sim.msgq_attach demo          # bounded run + honest skip if no image
 ```
 
 Measured today: **B3 reached** (~474k instructions), doorbell write performed
-and checksum-verified; the **libos port model** then completes the
+and checksum-verified; the **libos port model** completes the
 external-interrupt receive handoff (`wait @ 0x4019df4: completed shuttle 10
-(extintr) size=0`), and the loop task's next syscall is `TASK_STATE_QUERY` at
-`0x401a46c` — the libos trap/report path. **First ring poll: still none**, and
-the report says exactly why (trap state for the query; the command-queue
-consumer task is never scheduled in this single-hart model; the
-`GSP_ARGUMENTS_CACHED` address handoff is not delivered). No fabricated poll;
-two runs are byte-identical.
+(extintr) size=0`) and serves the following `TASK_STATE_QUERY` with a modelled
+spurious/EINT trap state, so the init task consumes the report and re-blocks.
+The image's **two linked tasks are discovered from its own section/manifest
+records** (an init task and the RM task); the **scheduled second task** then
+completes its boot port handshake with the init task inside the bounded
+budget (`modelled:cross-task-send` / `modelled:cross-task-reply`, payloads
+copied from firmware memory), after which its own start-up continues past the
+2M instruction cap before its first further port syscall. **First ring poll:
+still none**, and the report says exactly why
+(`missing_semantic.stage = second-task-frontier`: the consumer start-up is not
+reachable from its entry inside the cap; the `GSP_ARGUMENTS_CACHED`
+queue-address handoff is not delivered; the doorbell→consumer binding is not
+modelled). No fabricated poll; two runs are byte-identical.
 
 ---
 
@@ -243,3 +250,4 @@ Ordered by what each unblocks; each is bounded and session-recorded.
 | Date | Change |
 |---|---|
 | 2026-10-06 | Created with the four new tools (`state_decode`, `log_decode`, `server_snapshot`, `msgq_attach`), the layer map, the run-to-the-wall procedure and the continuation loop. |
+| 2026-10-06 | Continuation: `sim/libos_port.py` + two-task B5 attach (extintr handoff completes; first poll still blocked on post-init resume + `GSP_ARGUMENTS_CACHED`); `state_decode` gains aggregate `key: value` state parsing (m26→m29 diff). |