kernel: GR context-promote bisection modes 4-17 and server-managed-ctxbuf registry variant; complete vgsp rename; docs/tooling refresh

- gsp_phys_booter: GR promote bisection modes 4-17 (two-phase zero-field VA,
  batched entries, hVirtMemory, bare VA, KMD SKIP_CTXBUFFER_ALLOC channel,
  old-interface GPU_INITIALIZE_CTX, FBMEM context buffer, UVM-faithful PA-only,
  PATCH/PM auxiliary promotes, server-managed no-promote path); PATCH/PM
  geometry queries and buffers; pre-boot SET_REGISTRY profile selection
- gsp_phys_gpu: gsp_phys_rmcall_gr_promote clamp 0..17 and gsp_phys_srv_ctxbuf
  parameter; registry image variant with RMSetClientRMAllocatedCtxBuffer=0
- vgsp rename across kernel, scripts, tools and docs (module vgsp.ko,
  /sys/kernel/debug/vgsp/, vgsp-<subsystem>: log prefixes)
- risc-v-gsp-rm-debugger user-facing rename and docs/CI refresh; guest-diag
  tool updates; README/SBOM/install/Makefile sync

Live status: CE ladder and P6 guest-copy forwarding green; GR engine context
commit still open (all promote shapes accepted or cleanly refused; the channel
stays CTXNOTVALID) - see Handoff-vGPU-IO.md Addendum 21 (local).

14 files changed, 30 insertions, 30 deletions

diff --git a/debug/risc-v-gsp-rm-vm/README.md b/debug/risc-v-gsp-rm-vm/README.md
index 8882f9a..61204af 100644
--- a/debug/risc-v-gsp-rm-vm/README.md
+++ b/debug/risc-v-gsp-rm-vm/README.md
@@ -2,7 +2,7 @@
 
 > Status: implemented, documented and tested (audit: docs/27-TOOL-AUDIT.md; value demos: docs/25-VALUE-VALIDATION.md).
 > Experimental tooling for simulating and inspecting the GSP firmware's
-> runtime memory, for `gsp-rm-vfio` accuracy measurements and GSP/uproc
+> runtime memory, for `vgsp` accuracy measurements and GSP/uproc
 > reverse engineering. It is a development-only, out-of-tree tool: never a
 > dependency of the shipped driver and never present in a guest.
 
diff --git a/debug/risc-v-gsp-rm-vm/RISC-V-GSP-RM-DEBUGGER-ROADMAP.md b/debug/risc-v-gsp-rm-vm/RISC-V-GSP-RM-DEBUGGER-ROADMAP.md
index 88183ea..a7a8227 100644
--- a/debug/risc-v-gsp-rm-vm/RISC-V-GSP-RM-DEBUGGER-ROADMAP.md
+++ b/debug/risc-v-gsp-rm-vm/RISC-V-GSP-RM-DEBUGGER-ROADMAP.md
@@ -12,7 +12,7 @@ Open-IOV's hardest long-term problem is not writing the emulation once — it is
 **surviving adversarial firmware change**. NVIDIA ships new GSP images, new
 device pairings and new architectures on independent schedules, and the
 firmware is deliberately opaque (stripped, signed, hardware-coupled, with
-non-recoverable boot states). To keep `open-iov-vfio` accurate across that
+non-recoverable boot states). To keep `vgsp` accurate across that
 churn, the project needs a toolchain that can:
 
 1. **Run** firmware off-hardware, safely and repeatably.
@@ -22,7 +22,7 @@ churn, the project needs a toolchain that can:
 4. **Compare** — hardware vs VFIO vs simulation, old vs new firmware, with a
    metric contract instead of anecdotes.
 5. **Reimplement** — turn observed behaviour into reviewed code in
-   `open-iov-vfio` with evidence attached.
+   `vgsp` with evidence attached.
 
 risc-v-gsp-rm-debugger is the vehicle for that program. It is explicitly a **development
 environment**, never a shipped component.
@@ -226,7 +226,7 @@ reimplement quickly.
 Observe what each service reads/writes (watchpoints, TCG trace) and infer
 capabilities (which objects, ranges, controls it touches); compare with the
 declared/emulated capability model; surface least-privilege and security
-findings for `open-iov-vfio`.
+findings for `vgsp`.
 
 ### H4.3 Mutation and fuzzing
 Feed malformed construction/control traffic into re-hosted or simulated
@@ -247,7 +247,7 @@ The canonical loop for any behaviour:
 1. Observe on hardware/VFIO (reference capture).
 2. Observe in risc-v-gsp-rm-debugger (simulator, replayable).
 3. `compare` + metric table M1–M6 (docs/06-ACCURACY.md).
-4. Implement in `open-iov-vfio` with the session directories attached as
+4. Implement in `vgsp` with the session directories attached as
    evidence.
 5. Re-run the same stimulus; the metric table must improve or stay equal.
 This loop becomes a scripted harness ("consensus harness") so every change
diff --git a/debug/risc-v-gsp-rm-vm/docs/00-OVERVIEW.md b/debug/risc-v-gsp-rm-vm/docs/00-OVERVIEW.md
index a404663..0df8d08 100644
--- a/debug/risc-v-gsp-rm-vm/docs/00-OVERVIEW.md
+++ b/debug/risc-v-gsp-rm-vm/docs/00-OVERVIEW.md
@@ -2,7 +2,7 @@
 
 > Status: implemented, documented and tested (audit: docs/27-TOOL-AUDIT.md; value demos: docs/25-VALUE-VALIDATION.md).
 > Experimental tooling for simulating and inspecting the GSP firmware's
-> runtime memory, for `gsp-rm-vfio` accuracy measurements and GSP/uproc
+> runtime memory, for `vgsp` accuracy measurements and GSP/uproc
 > reverse engineering. Interfaces and file formats may change without notice.
 > It is development-only: never shipped, never a dependency of the emulation,
 > never present in a guest.
diff --git a/debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md b/debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md
index e55162d..ebc9226 100644
--- a/debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md
+++ b/debug/risc-v-gsp-rm-vm/docs/06-ACCURACY.md
@@ -7,7 +7,7 @@
 ## 1. Purpose
 
 risc-v-gsp-rm-debugger exists to measure how accurately Open-IOV's GSP emulation
-(`gsp-rm-vfio` and the in-kernel emulation) reproduces the behaviour of the
+(`vgsp` and the in-kernel emulation) reproduces the behaviour of the
 real GSP firmware, and to make the firmware itself analysable. That makes
 accuracy a first-class deliverable, not an assumption. This document defines
 the fidelity levels, the measurement contract, and the rules for honest
@@ -73,7 +73,7 @@ Re-host fidelity must be stated per module in the session metadata, and every
 "this is what the firmware does" claim should be cross-checked against the
 physical RPC traces (PLAN B) before it is used to change the emulation.
 
-## 5. Measurement contract for `gsp-rm-vfio` accuracy
+## 5. Measurement contract for `vgsp` accuracy
 
 Define these metrics once and use them everywhere:
 
diff --git a/debug/risc-v-gsp-rm-vm/docs/11-GSP-RM-SERVICE-DEVELOPER-GUIDE.md b/debug/risc-v-gsp-rm-vm/docs/11-GSP-RM-SERVICE-DEVELOPER-GUIDE.md
index 2022cf1..714dc27 100644
--- a/debug/risc-v-gsp-rm-vm/docs/11-GSP-RM-SERVICE-DEVELOPER-GUIDE.md
+++ b/debug/risc-v-gsp-rm-vm/docs/11-GSP-RM-SERVICE-DEVELOPER-GUIDE.md
@@ -149,7 +149,7 @@ prototype is analysed exactly like firmware code.
 * **Watchpoint the state, hook the entry.** Watchpoints are immediate (one
   instruction step) and ideal for counters; hooks give arguments/returns.
 * **Never ship a service.** Injected code is a development experiment; the
-  product changes go through `open-iov-vfio` with the accuracy loop.
+  product changes go through `vgsp` with the accuracy loop.
 * **Record everything.** A claim about a service without a session is not
   evidence.
 
diff --git a/debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md b/debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md
index 1ddd17e..c000d42 100644
--- a/debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md
+++ b/debug/risc-v-gsp-rm-vm/docs/14-ADVERSARIAL-INTEROP-GUIDE.md
@@ -5,7 +5,7 @@
 ## 1. Purpose and scope
 
 Open-IOV's hard problem is not writing the GSP emulation once; it is keeping
-`open-iov-vfio` accurate while the firmware changes underneath it. New GSP
+`vgsp` accurate while the firmware changes underneath it. New GSP
 images, device pairings and architectures arrive stripped, signed and
 hardware-coupled, and some actively resist analysis. This guide is the
 practical companion to `RISC-V-GSP-RM-DEBUGGER-ROADMAP.md` H4: how to move from "the new
@@ -47,7 +47,7 @@ hardware coupling a simulator cannot yet exercise.
    question > Ghidra (static): decompile, dispatcher tables, symbols
             > risc-v-gsp-rm-debugger (dynamic): same stimulus, hooks, watchpoints, trace
             > sessions + hits TSV: risc-v-gsp-rm-debugger compare -> triage -> evidence pack
-            > open-iov-vfio change (with evidence)
+            > vgsp change (with evidence)
 ```
 
 | Question | Ghidra answers | risc-v-gsp-rm-debugger answers | Shared artifact |
@@ -170,7 +170,7 @@ with the capability model the emulation assumes.
    | write | `0x…` | w | `func+0x…` | not modelled | least-privilege candidate |
    | read | `0x…` | r | `func+0x…` | denied in emulation | potential fail-closed gap |
 
-   Least-privilege readings matter for `open-iov-vfio`, but a simulator
+   Least-privilege readings matter for `vgsp`, but a simulator
    observation is evidence about the firmware (docs/06 §6); confirm before it
    changes the product.
 
@@ -294,7 +294,7 @@ reproduced physically; simulator-only divergence becomes a fidelity gap.
 
 The canonical accuracy loop (roadmap H4.5): (1) observe on hardware/VFIO;
 (2) observe in risc-v-gsp-rm-debugger (replayable session); (3) `compare` + M1–M6;
-(4) implement in `open-iov-vfio` with the session directories attached as
+(4) implement in `vgsp` with the session directories attached as
 evidence; (5) re-run the same stimulus and require the metric table to improve
 or stay equal.
 
@@ -367,7 +367,7 @@ L0/L1 in simulator; L2 not claimed; L3 absent for <registers>.
 Physical reproduction required before product change: yes/no, why.
 
 ## Product action
-open-iov-vfio change (or explicit "no change"): <link/notes>
+vgsp change (or explicit "no change"): <link/notes>
 ```
 
 ## 7. Boundaries, safety and ethics
@@ -384,7 +384,7 @@ open-iov-vfio change (or explicit "no change"): <link/notes>
 * **Fuzzing is gated.** Mutation runs only against the simulator or re-hosted
   code, behind explicit harnesses, with session evidence (docs/12 §9, R5).
   Never use injection to defeat a hardware security boundary (docs/12 §1).
-* **Escalate to physical.** Any conclusion that would change `open-iov-vfio`
+* **Escalate to physical.** Any conclusion that would change `vgsp`
   must be confirmed against a physical capture (docs/06 §6, docs/07 P4.5).
 
 ## 8. Roadmap hooks
diff --git a/debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md b/debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md
index db71833..a7feb21 100644
--- a/debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md
+++ b/debug/risc-v-gsp-rm-vm/docs/15-AGENTIC-GSP-IDE.md
@@ -14,7 +14,7 @@ a **deterministic, scriptable harness** (`ge.launch`/`ge.attach`, `Session`,
 * sessions are the shared state between agents, humans and Ghidra, so every
   claim is inspectable after the fact;
 * **humans keep product-change authority**: an agent may propose an
-  `open-iov-vfio` change with evidence, but only a human merges it, and the
+  `vgsp` change with evidence, but only a human merges it, and the
   physical-confirmation rules of docs/06 and docs/07 still apply.
 
 Non-goals: autonomous hardware cycles, unattended reboots, agents that "fix"
@@ -249,7 +249,7 @@ the reply/object, and in what order relative to `<Z>`?"
 
 6. Stop condition: direct and firmware-dispatched results agree, the session
    is recorded, and the prototype is documented as development-only. Product
-   code goes to `open-iov-vfio` only through the accuracy loop (docs/11 §8,
+   code goes to `vgsp` only through the accuracy loop (docs/11 §8,
    docs/12 §9); GSP-RM registration is roadmap H1.3.
 
 ### 4.4 Prepare a portability report
@@ -288,7 +288,7 @@ Hard rules (no agent may override them):
 * **No unattended hardware.** The agent runs against the simulator by default;
   physical GPU cycles are supervised and human-driven (H7).
 * **Human approval for product changes.** Agents produce proposals and
-  evidence packs; only humans merge `open-iov-vfio` changes.
+  evidence packs; only humans merge `vgsp` changes.
 * **Budgets everywhere.** Every run uses `duration=`/`max_stops=`/`timeout=`
   and a wall-clock cap; a wedged target leaves the session stopped and is
   restarted clean rather than poked.
@@ -300,7 +300,7 @@ Capability manifest for actions (proposed file for the harness; see §7):
 | Read | `info`, `plugins`, `symbols resolve`, `analyze`, `compare` | agent, unattended | path/DB provenance recorded |
 | Observe | `probe`, `record`, `demo`, hooks/watch/step | agent, unattended on simulator | timeout, session recording on |
 | Write (target) | `memory.write*`, `call`, `run_until`, `inject`, mailbox stimulus | agent with manifest | declared address/range, fresh session, before/after snapshots, mutation values noted |
-| Product | `open-iov-vfio` patch | human only | M1–M6 + physical confirmation rules (docs/07 P4.5) |
+| Product | `vgsp` patch | human only | M1–M6 + physical confirmation rules (docs/07 P4.5) |
 | Hardware | physical cycles/reboots | human only | supervised, never unattended |
 
 A write action's manifest entry names the session, the target range, the
diff --git a/debug/risc-v-gsp-rm-vm/docs/16-CUSTOM-SIMULATOR.md b/debug/risc-v-gsp-rm-vm/docs/16-CUSTOM-SIMULATOR.md
index 4e96a44..b2980bc 100644
--- a/debug/risc-v-gsp-rm-vm/docs/16-CUSTOM-SIMULATOR.md
+++ b/debug/risc-v-gsp-rm-vm/docs/16-CUSTOM-SIMULATOR.md
@@ -160,7 +160,7 @@ adds: differential tests against QEMU, gate behind H2, minimal `Backend`.
 * Confidentiality/isolation/security claims: a study environment only (§06 §6).
 * Replacing QEMU before M4; native is opt-in (`--backend native`, M6).
 * Graphics/board emulation, undeclared fidelity claims, or shipping: nothing
-  here becomes a dependency of `gsp-rm-vfio` or a guest.
+  here becomes a dependency of `vgsp` or a guest.
 
 ### 3.1 Fidelity claims
 
diff --git a/debug/risc-v-gsp-rm-vm/docs/20-MCP-SERVER.md b/debug/risc-v-gsp-rm-vm/docs/20-MCP-SERVER.md
index 4c13d1f..46e28a4 100644
--- a/debug/risc-v-gsp-rm-vm/docs/20-MCP-SERVER.md
+++ b/debug/risc-v-gsp-rm-vm/docs/20-MCP-SERVER.md
@@ -241,7 +241,7 @@ recorded, and the session can be compared like any other run.
 6. **Protocol hygiene.** stdout is reserved for JSON-RPC; diagnostics go to
    stderr. One bad tool call returns `isError` and the server keeps serving.
 7. **No product changes.** MCP can propose evidence, not merge emulation
-   changes; human approval still gates `open-iov-vfio`.
+   changes; human approval still gates `vgsp`.
 
 ## 8. Absent capabilities
 
diff --git a/debug/risc-v-gsp-rm-vm/docs/22-PORTING-CUDA-AND-DEVICES.md b/debug/risc-v-gsp-rm-vm/docs/22-PORTING-CUDA-AND-DEVICES.md
index 63fbffa..8570d0d 100644
--- a/debug/risc-v-gsp-rm-vm/docs/22-PORTING-CUDA-AND-DEVICES.md
+++ b/debug/risc-v-gsp-rm-vm/docs/22-PORTING-CUDA-AND-DEVICES.md
@@ -9,7 +9,7 @@
 ## 1. The three churn axes and the anchor discipline
 
 NVIDIA ships three things on independent schedules, and any one of them can
-break `open-iov-vfio` while the other two stay still:
+break `vgsp` while the other two stay still:
 
 | Axis | Examples | Primary evidence path |
 |---|---|---|
@@ -76,7 +76,7 @@ tools/cudatool.py delta   <old>/run/libcuda.so.<old> <new>/run/libcuda.so.<new>
 | Name transfer + corpus annotation | `ApplyNameMap.java` (`--dry-run` first), `tools/annotate_corpus.py` | `./risc-v-gsp-rm-debugger.sh symbols export` builds a runtime-address symbol DB from the same index/names |
 | Driver-API smoke | `tools/test/cuda_drv_test.c` compiled as `/tmp/cdt` (prints `ALL OK`) | `./risc-v-gsp-rm-debugger.sh symbols resolve --db ... <addr>` spot-checks transferred addresses per call path |
 | Runtime workload | `tools/cuda-ab/ab.sh all` (`vector_add.cu`; `RESULT`/`STATUS` must match host) | session-format evidence and `./risc-v-gsp-rm-debugger.sh compare` when firmware-side sessions exist |
-| Guest-side control observation | `tools/guest-diag/ioctl_trace.c`, host module trace (`gsp-resman-vfio:`) | annotation of the firmware-side RPC path with the per-version symbol DB |
+| Guest-side control observation | `tools/guest-diag/ioctl_trace.c`, host module trace (`vgsp:`) | annotation of the firmware-side RPC path with the per-version symbol DB |
 | Firmware-side confirmation | — | `./risc-v-gsp-rm-debugger.sh probe` / `record` / `compare` against the paired firmware |
 
 **Be honest about the execution boundary.** `cdt` and `vectorAdd` are x86_64
@@ -182,7 +182,7 @@ remains the dynamic oracle.
 | Engine inventory | host oracle `rmtool engine list --format=json`, guest `guest_engines.c` | inventory table |
 | Interrupt topology | MSI-X tables, guest `lspci -vvv` | profile notes |
 | ROM/VBIOS quirks | ROM read, laptop/Surface variants | profile overrides |
-| Probe-time register values | guest driver init trace (`gsp-resman-vfio:`) | expected-value list |
+| Probe-time register values | guest driver init trace (`vgsp:`) | expected-value list |
 
 The host oracle (`rmharness`, docs/17) is read-only and safe alongside a live
 CUDA job; capture it into a session so the numbers carry SHA-256 provenance:
diff --git a/debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md b/debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md
index 93d5d17..f7ccacd 100644
--- a/debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md
+++ b/debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md
@@ -33,7 +33,7 @@ the baseline cost from the handoffs, and measures the risc-v-gsp-rm-debugger pat
 Fidelity is exactly docs/06: L0 instruction semantics and L1 memory behaviour
 are exercised; **L2 time/concurrency is not modelled** and **L3 device
 environment is absent**. A risc-v-gsp-rm-debugger observation is evidence about the
-firmware, and anything that would change `open-iov-vfio` is escalated to a
+firmware, and anything that would change `vgsp` is escalated to a
 physical capture before the product changes (docs/06 §6, docs/14 §7).
 
 ### 2.2 Run contract
diff --git a/debug/risc-v-gsp-rm-vm/docs/26-ARCHITECTURE.md b/debug/risc-v-gsp-rm-vm/docs/26-ARCHITECTURE.md
index e4b8396..fce7a96 100644
--- a/debug/risc-v-gsp-rm-vm/docs/26-ARCHITECTURE.md
+++ b/debug/risc-v-gsp-rm-vm/docs/26-ARCHITECTURE.md
@@ -10,7 +10,7 @@
 
 risc-v-gsp-rm-debugger runs GSP/uproc firmware in a controllable machine, observes it with
 Frida-like primitives, records a durable session, changes the machine's inputs
-(including injected code), and compares runs as evidence for `open-iov-vfio`
+(including injected code), and compares runs as evidence for `vgsp`
 emulation changes.
 
 | It is | It is not |
@@ -342,7 +342,7 @@ The canonical loop (H4.5, 06 §5, 07 P4, 25 §7). Each stage names its gate.
 | 4. Record | `greeneye-session/1` with snapshots and notes | events + snapshots + hashes written | missing `session.json`/empty analyzer → recording off |
 | 5. Compare | `compare` against a reference (old firmware, hardware/VFIO capture, self-diff) | deltas explained symbolically; self-diff is zero | unexplained hit/watch/write delta → investigate first |
 | 6. Decide | fill M1–M6 with the reference method (06 §5); mutation/triage for error paths | metric table improves or stays equal | metric claimed without a reference capture |
-| 7. Implement | change `open-iov-vfio` (never the simulator for a product fix); keep the stimulus | physical confirmation for behaviour changes (06 §6, 14 §7) | product change from a simulator-only observation |
+| 7. Implement | change `vgsp` (never the simulator for a product fix); keep the stimulus | physical confirmation for behaviour changes (06 §6, 14 §7) | product change from a simulator-only observation |
 | 8. Regression | re-run step 3 with an unchanged stimulus; golden sessions/CI (`make test`, `risc-v-gsp-rm-debugger.yml`) | profile improves or stays equal; CI green | regression → revert and re-derive |
 
 ```mermaid
@@ -350,7 +350,7 @@ flowchart LR
   Q["Question"] --> OBS["Observe<br/>probe / hooks / watch / trace"]
   OBS --> ORI["Orient<br/>analyze + symbol decode + snapshots"]
   ORI --> DEC["Decide<br/>compare + M1-M6 + mutation"]
-  DEC --> ACT["Act<br/>implement in open-iov-vfio"]
+  DEC --> ACT["Act<br/>implement in vgsp"]
   ACT --> REG["Regression<br/>same stimulus, same budgets"]
   REG -->|"improved / equal"| SHIP["Evidence pack<br/>sessions + report + hashes"]
   REG -->|"regressed"| Q
diff --git a/debug/risc-v-gsp-rm-vm/docs/28-PORTING-AUTOMATION.md b/debug/risc-v-gsp-rm-vm/docs/28-PORTING-AUTOMATION.md
index 974f013..b10542f 100644
--- a/debug/risc-v-gsp-rm-vm/docs/28-PORTING-AUTOMATION.md
+++ b/debug/risc-v-gsp-rm-vm/docs/28-PORTING-AUTOMATION.md
@@ -283,7 +283,7 @@ rather than recompute hashes.
   sweep handles the ISA/image shape and the matrix records the first-touch
   deltas, but PMU/SOE and partition-model work belongs to the roadmap.
 * **New product behaviour** — out of scope: these tools produce evidence, they
-  never edit `open-iov-vfio`. Product changes need the docs/07 P4 escalation
+  never edit `vgsp`. Product changes need the docs/07 P4 escalation
   and a physical reference.
 
 ---
diff --git a/debug/risc-v-gsp-rm-vm/docs/29-PACKAGING-AND-TRIALING.md b/debug/risc-v-gsp-rm-vm/docs/29-PACKAGING-AND-TRIALING.md
index 53e0f03..1a0e12a 100644
--- a/debug/risc-v-gsp-rm-vm/docs/29-PACKAGING-AND-TRIALING.md
+++ b/debug/risc-v-gsp-rm-vm/docs/29-PACKAGING-AND-TRIALING.md
@@ -171,7 +171,7 @@ status; a thrown error is recorded and exits 1.
    and expects the same `status`/call results. Divergence is a finding against
    the package or the tree, not a nuance.
 5. Nothing here is product evidence by itself: any conclusion that would
-   change `open-iov-vfio` still escalates to a physical capture (docs/06 §6,
+   change `vgsp` still escalates to a physical capture (docs/06 §6,
    docs/25 §2.1). The package makes that physical confirmation cheap, it does
    not replace it.