debug: risc-v-gsp-rm-debugger final pass - remove in-development notices, complete rename, adversarial-review fixes

Remove the '# TOOL IN DEVELOPMENT - NOT READY YET!' notices from the tool docs/README/scripts and the project docs; record the removal (2026-10-02) against the tool audit (debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md), the 194-test suite and the value-validation demos (docs/25-VALUE-VALIDATION.md).

Complete the cosmetic rename to risc-v-gsp-rm-debugger in user-facing prose and commands (launcher, roadmap, docs); internal greeneye package and code identifiers unchanged.

Adversarial-review fixes: deterministic control-discovery sweep (flaky test root-caused), UUID session dirs + atomic JSON writes for concurrent runs, Ghidra bridge loopback enforcement and clean shutdown, fp register restore in Session.call, version_diff --dry-run, 30 s interrupt budget, dry-run non-destructiveness verified.

Docs: flag-removal records, link fixes, command/flag corrections (fdematch arity, port_new_device --out, trace filename), F2 orchestration note in future-eng-ops; STATE-CURRENT status refreshed.

5 files changed, 39 insertions, 18 deletions

diff --git a/debug/risc-v-gsp-rm-vm/harness/value_demos/_common.py b/debug/risc-v-gsp-rm-vm/harness/value_demos/_common.py
index 0733c48..ebbc390 100644
--- a/debug/risc-v-gsp-rm-vm/harness/value_demos/_common.py
+++ b/debug/risc-v-gsp-rm-vm/harness/value_demos/_common.py
@@ -17,6 +17,7 @@ import json
 import os
 import shutil
 import sys
+import tempfile
 import time
 
 HERE = os.path.dirname(os.path.abspath(__file__))
@@ -95,11 +96,24 @@ def artifact_dir(name: str) -> str:
     return path
 
 
+def session_dir(root: str, label: str = "session") -> str:
+    """A unique recording dir under ``root``.
+
+    Demos share a fixed artifact root so their reports are discoverable, but
+    two concurrent demo runs (tests, agents) must never share one
+    ``events.jsonl`` or a reader can see a half-written recording.
+    """
+    os.makedirs(root, exist_ok=True)
+    return tempfile.mkdtemp(prefix=f"{label}-", dir=root)
+
+
 def write_json(path: str, payload) -> str:
     os.makedirs(os.path.dirname(path), exist_ok=True)
-    with open(path, "w", encoding="utf-8") as fh:
+    tmp = f"{path}.tmp-{os.getpid()}"
+    with open(tmp, "w", encoding="utf-8") as fh:
         json.dump(payload, fh, indent=2, sort_keys=True)
         fh.write("\n")
+    os.replace(tmp, path)
     return path
 
 
diff --git a/debug/risc-v-gsp-rm-vm/harness/value_demos/s06_inject_service.py b/debug/risc-v-gsp-rm-vm/harness/value_demos/s06_inject_service.py
index 04dd001..dc5949e 100644
--- a/debug/risc-v-gsp-rm-vm/harness/value_demos/s06_inject_service.py
+++ b/debug/risc-v-gsp-rm-vm/harness/value_demos/s06_inject_service.py
@@ -76,7 +76,8 @@ def run() -> dict:
         C.write_json(os.path.join(out, "inject.json"), payload)
         return payload
 
-    session = ge.launch(kernel=C.DEMO_ELF, backend=backend, record=os.path.join(out, "session"), name="vd-s06")
+    session_dir = C.session_dir(out)
+    session = ge.launch(kernel=C.DEMO_ELF, backend=backend, record=session_dir, name="vd-s06")
     try:
         ctrl = session.symbols.lookup("gsp_ctrl")
         session.run(duration=0.25)
@@ -96,7 +97,7 @@ def run() -> dict:
             "remote": {"ping": remote_ping, "sum": remote_sum},
             "via_firmware": {"ping": via_fw_ping, "sum": via_fw_sum},
             "mailbox_command": C.INJECT_CMD_BASE + C.SERVICE_SLOT,
-            "session": os.path.relpath(os.path.join(out, "session"), C.TOOL_ROOT),
+            "session": os.path.relpath(session_dir, C.TOOL_ROOT),
             "question": "load/register/invoke a service blob end-to-end, both routes",
             "answer": (
                 f"service loaded at {service.load_addr:#x}, slot {service.slot} "
diff --git a/debug/risc-v-gsp-rm-vm/harness/value_demos/s07_version_diff.py b/debug/risc-v-gsp-rm-vm/harness/value_demos/s07_version_diff.py
index eaad957..e752807 100644
--- a/debug/risc-v-gsp-rm-vm/harness/value_demos/s07_version_diff.py
+++ b/debug/risc-v-gsp-rm-vm/harness/value_demos/s07_version_diff.py
@@ -106,8 +106,10 @@ def run() -> dict:
 
     schema = C.load_schema(ge)
     results = {}
+    session_dirs = {}
     for label, path in (("A", va), ("B", vb)):
-        session = ge.launch(kernel=path, backend=backend, record=os.path.join(out, f"session-{label}"), name=f"vd-s07-{label}")
+        session_dirs[label] = C.session_dir(out, f"session-{label}")
+        session = ge.launch(kernel=path, backend=backend, record=session_dirs[label], name=f"vd-s07-{label}")
         try:
             ctrl = session.symbols.lookup("gsp_ctrl")
             dispatches = []
@@ -134,7 +136,7 @@ def run() -> dict:
             session.close()
 
     compare_md = compare_sessions(
-        os.path.join(out, "session-A"), os.path.join(out, "session-B"), symbols=session.symbols, max_rows=20
+        session_dirs["A"], session_dirs["B"], symbols=session.symbols, max_rows=20
     )
     C.write_text(os.path.join(out, "compare-sessions.md"), compare_md)
     moved = sorted(
diff --git a/debug/risc-v-gsp-rm-vm/harness/value_demos/s09_grabbing_a_ghidra_address.py b/debug/risc-v-gsp-rm-vm/harness/value_demos/s09_grabbing_a_ghidra_address.py
index 1d30b58..5bd1efe 100644
--- a/debug/risc-v-gsp-rm-vm/harness/value_demos/s09_grabbing_a_ghidra_address.py
+++ b/debug/risc-v-gsp-rm-vm/harness/value_demos/s09_grabbing_a_ghidra_address.py
@@ -51,7 +51,8 @@ def run() -> dict:
 
     backend = C.choose_backend("qemu")
     out = C.artifact_dir("s09_grabbing_a_ghidra_address")
-    names_tsv = os.path.join(out, "ghidra_names.tsv")
+    session_dir = C.session_dir(out)
+    names_tsv = os.path.join(session_dir, "ghidra_names.tsv")
     facts = _ghidra_tsv(ge, names_tsv)
     runtime_rpc_fault = ge.load_elf(C.DEMO_ELF)
     addr_rpc_fault = None
@@ -95,7 +96,8 @@ def run() -> dict:
         commands,
     )
 
-    session = ge.launch(kernel=C.DEMO_ELF, backend=backend, record=os.path.join(out, "session"), name="vd-s09")
+    session_dir = C.session_dir(out)
+    session = ge.launch(kernel=C.DEMO_ELF, backend=backend, record=session_dir, name="vd-s09")
     try:
         session.symbols.load_names_tsv(names_tsv, bias=BIAS)
         ctrl = session.symbols.lookup("gsp_ctrl")
@@ -105,7 +107,7 @@ def run() -> dict:
         session.run(duration=0.25)
         session.memory.write_u64(ctrl + C.CTRL_MAILBOX, 6)
         session.run(duration=0.25)
-        hits_tsv = export_hits(os.path.join(out, "session"), os.path.join(out, "greeneye_hits.tsv"), symbols=session.symbols)
+        hits_tsv = export_hits(session_dir, os.path.join(session_dir, "greeneye_hits.tsv"), symbols=session.symbols)
         payload = {
             "success": len(hits) >= 1 and resolved == addr_rpc_fault,
             "backend": backend,
diff --git a/debug/risc-v-gsp-rm-vm/harness/value_demos/s10_full_session_evidence.py b/debug/risc-v-gsp-rm-vm/harness/value_demos/s10_full_session_evidence.py
index f6cd48f..75d7b1e 100644
--- a/debug/risc-v-gsp-rm-vm/harness/value_demos/s10_full_session_evidence.py
+++ b/debug/risc-v-gsp-rm-vm/harness/value_demos/s10_full_session_evidence.py
@@ -67,7 +67,7 @@ def _trace_overhead(ge, out: str) -> dict:
     import time
 
     def timed(trace):
-        record = os.path.join(out, "trace-off" if not trace else "trace-on")
+        record = C.session_dir(out, "trace-on" if trace else "trace-off")
         start = time.monotonic()
         session = ge.launch(kernel=C.DEMO_ELF, backend="native", record=record, trace=trace, name="vd-s10-trace")
         run_start = time.monotonic()
@@ -134,19 +134,21 @@ def run() -> dict:
     )
 
     start = time.monotonic()
-    session_a = _stimulus(ge, os.path.join(out, "session-A"), backend)
-    session_b = _stimulus(ge, os.path.join(out, "session-B"), backend)
+    session_a_dir = C.session_dir(out, "session-A")
+    session_b_dir = C.session_dir(out, "session-B")
+    session_a = _stimulus(ge, session_a_dir, backend)
+    session_b = _stimulus(ge, session_b_dir, backend)
 
     symbols = ge.SymbolDB()
     symbols.load_elf(ge.load_elf(C.DEMO_ELF))
-    report = render_summary(os.path.join(out, "session-A"), symbols=symbols, max_rows=30)
+    report = render_summary(session_a_dir, symbols=symbols, max_rows=30)
     C.write_text(os.path.join(out, "analyze.md"), report)
-    compare = compare_sessions(os.path.join(out, "session-A"), os.path.join(out, "session-B"), symbols=symbols, max_rows=30)
+    compare = compare_sessions(session_a_dir, session_b_dir, symbols=symbols, max_rows=30)
     C.write_text(os.path.join(out, "compare.md"), compare)
-    hits = export_hits(os.path.join(out, "session-A"), os.path.join(out, "greeneye_hits.tsv"), symbols=symbols)
+    hits = export_hits(session_a_dir, os.path.join(out, "greeneye_hits.tsv"), symbols=symbols)
     trace = _trace_overhead(ge, out)
-    size_a = _dir_size(os.path.join(out, "session-A"))
-    size_b = _dir_size(os.path.join(out, "session-B"))
+    size_a = _dir_size(session_a_dir)
+    size_b = _dir_size(session_b_dir)
     deltas_match = session_a["dispatches"] == session_b["dispatches"] and session_a["ping_reply"] == session_b["ping_reply"]
     manifest = {
         "format": "greeneye-value-evidence/1",
@@ -155,8 +157,8 @@ def run() -> dict:
             "sha256": C.sha256_file(C.DEMO_ELF),
         },
         "sessions": {
-            "a": {"path": os.path.relpath(os.path.join(out, "session-A"), C.TOOL_ROOT), "bytes": size_a, "sha256_manifest": C.sha256_file(os.path.join(out, "session-A", "events.jsonl"))},
-            "b": {"path": os.path.relpath(os.path.join(out, "session-B"), C.TOOL_ROOT), "bytes": size_b, "sha256_manifest": C.sha256_file(os.path.join(out, "session-B", "events.jsonl"))},
+            "a": {"path": os.path.relpath(session_a_dir, C.TOOL_ROOT), "bytes": size_a, "sha256_manifest": C.sha256_file(os.path.join(session_a_dir, "events.jsonl"))},
+            "b": {"path": os.path.relpath(session_b_dir, C.TOOL_ROOT), "bytes": size_b, "sha256_manifest": C.sha256_file(os.path.join(session_b_dir, "events.jsonl"))},
         },
         "stimulus": {"commands": [1, 5], "arg0": 0x1234, "note": "PING then STATE"},
         "observed": {"a": session_a, "b": session_b, "delta_match": deltas_match},