risc-v-gsp-rm-debugger: B5 two-task attach + aggregate-state decode + docs 51/53 status

- sim/libos_port.py: port-role model + two-task network (extintr handoff,
  cross-task send/reply, TASK_STATE_QUERY trap state)
- sim/msgq_attach.py: image task discovery, bounded two-task schedule,
  second-task-frontier divergence fields (first ring poll still blocked on
  post-init resume + GSP_ARGUMENTS_CACHED handoff; no fabricated polls)
- harness/state_decode.py: aggregate 'group: key=value' state parsing
  (20-gsp-phys-state-* dumps) + kv diff classification
- tests: 127 green across the five observability modules
- docs/51/53: status and changelog updates

2 files changed, 30 insertions, 7 deletions

diff --git a/debug/risc-v-gsp-rm-vm/docs/51-HOST-TRAFFIC-LOOP.md b/debug/risc-v-gsp-rm-vm/docs/51-HOST-TRAFFIC-LOOP.md
index e56094c..30c2804 100644
--- a/debug/risc-v-gsp-rm-vm/docs/51-HOST-TRAFFIC-LOOP.md
+++ b/debug/risc-v-gsp-rm-vm/docs/51-HOST-TRAFFIC-LOOP.md
@@ -229,6 +229,21 @@ Next step for B5, concretely (each point is bounded and session-recorded):
 5. Then replay one captured stimulus message with the real image and record
    the reply/writes as the B5 session. Until a supervised capture exists,
    this stops at step 3–4 with the stub dispatcher.
+6. **Two-task wave (landed 2026-10-06).** `sim/msgq_attach.py` now discovers
+   the image's linked tasks from its own section/manifest records and
+   schedules the second one (the RM task) when the init task blocks:
+   `sim.libos_port.LibosPortNetwork` routes sends/receives/replies between
+   the modelled tasks with the firmware's own payload bytes, serves
+   `TASK_STATE_QUERY` with a modelled spurious/EINT trap state, and fixes the
+   synchronous receive semantics (a receive with a non-zero wait id blocks
+   instead of completing). Measured frontier: the RM task completes the boot
+   port handshake and then runs its own start-up past the 2M instruction cap
+   before its first further port syscall, so **no ring poll is reachable from
+   its entry inside the cap**; the report names the exact next semantics
+   (`missing_semantic.stage = second-task-frontier`): a data-driven post-init
+   resume point, the `GSP_ARGUMENTS_CACHED`/queue-init address handoff, and
+   the doorbell→consumer interrupt binding. Single-task behaviour is kept
+   with `--no-second-task` (and the old `task-state-query` classification).
 
 The seam for step 3 already exists: `HostTraffic(machine=..., shared_base=...)`
 uses the machine's RAM for the rings and `run_cycles` steps the core; the
diff --git a/debug/risc-v-gsp-rm-vm/docs/53-FIRMWARE-OBSERVABILITY-WORKFLOW.md b/debug/risc-v-gsp-rm-vm/docs/53-FIRMWARE-OBSERVABILITY-WORKFLOW.md
index 4106244..336f1b6 100644
--- a/debug/risc-v-gsp-rm-vm/docs/53-FIRMWARE-OBSERVABILITY-WORKFLOW.md
+++ b/debug/risc-v-gsp-rm-vm/docs/53-FIRMWARE-OBSERVABILITY-WORKFLOW.md
@@ -119,14 +119,21 @@ python3 -m sim.msgq_attach demo          # bounded run + honest skip if no image
 ```
 
 Measured today: **B3 reached** (~474k instructions), doorbell write performed
-and checksum-verified; the **libos port model** then completes the
+and checksum-verified; the **libos port model** completes the
 external-interrupt receive handoff (`wait @ 0x4019df4: completed shuttle 10
-(extintr) size=0`), and the loop task's next syscall is `TASK_STATE_QUERY` at
-`0x401a46c` — the libos trap/report path. **First ring poll: still none**, and
-the report says exactly why (trap state for the query; the command-queue
-consumer task is never scheduled in this single-hart model; the
-`GSP_ARGUMENTS_CACHED` address handoff is not delivered). No fabricated poll;
-two runs are byte-identical.
+(extintr) size=0`) and serves the following `TASK_STATE_QUERY` with a modelled
+spurious/EINT trap state, so the init task consumes the report and re-blocks.
+The image's **two linked tasks are discovered from its own section/manifest
+records** (an init task and the RM task); the **scheduled second task** then
+completes its boot port handshake with the init task inside the bounded
+budget (`modelled:cross-task-send` / `modelled:cross-task-reply`, payloads
+copied from firmware memory), after which its own start-up continues past the
+2M instruction cap before its first further port syscall. **First ring poll:
+still none**, and the report says exactly why
+(`missing_semantic.stage = second-task-frontier`: the consumer start-up is not
+reachable from its entry inside the cap; the `GSP_ARGUMENTS_CACHED`
+queue-address handoff is not delivered; the doorbell→consumer binding is not
+modelled). No fabricated poll; two runs are byte-identical.
 
 ---
 
@@ -243,3 +250,4 @@ Ordered by what each unblocks; each is bounded and session-recorded.
 | Date | Change |
 |---|---|
 | 2026-10-06 | Created with the four new tools (`state_decode`, `log_decode`, `server_snapshot`, `msgq_attach`), the layer map, the run-to-the-wall procedure and the continuation loop. |
+| 2026-10-06 | Continuation: `sim/libos_port.py` + two-task B5 attach (extintr handoff completes; first poll still blocked on post-init resume + `GSP_ARGUMENTS_CACHED`); `state_decode` gains aggregate `key: value` state parsing (m26→m29 diff). |