docs(review): fix GMMU-doc anchors and vEP vocabulary; index docs 13/14 in the READMEs

The GMMU doc cited pre-c33f6006 lines for the pump, doorbell and svc_sem_write,
defined vEP differently from doc 13 (which it names as the vocabulary
authority), and called Design A prototypable in the 1.0 programme while M6
classifies the same prototype as post-1.0 research. Fix all three, refresh
the status hash, and add the doc to the docs/ and wiki/ indexes with the
renumbered reading-order rows.

1 files changed, 22 insertions, 14 deletions

diff --git a/docs/03-architecture/14-multi-tenant-gmmu-protection.md b/docs/03-architecture/14-multi-tenant-gmmu-protection.md
index c3f58c7..060a600 100644
--- a/docs/03-architecture/14-multi-tenant-gmmu-protection.md
+++ b/docs/03-architecture/14-multi-tenant-gmmu-protection.md
@@ -1,6 +1,6 @@
 # Multi-Tenant GMMU Protection: Isolation Design and Paged-Attention Controls
 
-> **Status: design (2026-10-08, master `66388560`).** This document specifies
+> **Status: design (2026-10-08, master `1f571dda`).** This document specifies
 > how Open-IOV isolates multiple tenants — multiple mdevs *and* multiple
 > tenants inside one guest — at the GPU memory-management unit (GMMU), and how
 > a paged-attention inference stack (vLLM-style) can use those protections.
@@ -119,9 +119,9 @@ The **work/completion service is not**. `gsp_sema_service.c` holds one
 global `static struct sema_svc svc;` (`kernel/gsp_sema_service.c:676`), and:
 
 * the service thread pumps **the first open mdev it finds**
-  (`kernel/gsp_sema_service.c:13296-13308`);
+  (`kernel/gsp_sema_service.c:13352-13364`);
 * the work-submission doorbell carries no owner — `gsp_sema_service_doorbell(u32 token)`
-  (`kernel/gsp_sema_service.c:13456`), called from the VFIO write path with
+  (`kernel/gsp_sema_service.c:13512`), called from the VFIO write path with
   no mdev argument (`kernel/main.c:865`);
 * channel registrations are keyed by the guest-chosen `h_object` alone
   (`kernel/gsp_sema_service.c:847`, table bounded by `SVC_MAX_CHANNELS 128`
@@ -146,9 +146,11 @@ problem.** §2 fixes the ownership; §4 builds the GMMU policy on it.
 **Tenant** — isolation principal (`tenantId`): a VM/mdev at L0–L2, a logical
 serving principal inside a guest in §4. **Agent** — finest principal inside
 a tenant (`agentId`): a vLLM engine/worker, a CUDA context, a process.
-**vEP** — virtual execution plane: the per-instance mediator (guest
-emulation + work execution) for one mdev; see
-[`13-vexecution-plane.md`](13-vexecution-plane.md). **KV block** —
+**vEP** — the vGSP Execution Plane: the execution half of vGSP (guest work →
+physical execution → guest-visible completion), as defined in
+[`13-vexecution-plane.md`](13-vexecution-plane.md). This document's problem
+is that the vEP's work-service state is currently one global context rather
+than per-mdev. **KV block** —
 paged-attention cache page (vLLM `paged_attention_v2`: fixed-size blocks,
 one `block_tables` entry per logical block per sequence); a GPU allocation
 range, not a hardware object.
@@ -171,9 +173,9 @@ What exists and what changes:
 | `svc.chan[]` | keyed `h_object` (`gsp_sema_service.c:847`) | key `(vgpu, h_object)`; per-mdev lifetime reset |
 | `svc.vas[]` | keyed `h_vaspace` (`:988`) | key `(vgpu, h_vaspace)` |
 | learned VA→PA map / pins | keyed GPU VA (`:113-130`) | key `(vgpu, VA)`; per-mdev epoch |
-| doorbell token | ownerless (`:13456`, `main.c:865`) | `(vgpu, token)`; route to the owner's pump |
+| doorbell token | ownerless (`:13512`, `main.c:865`) | `(vgpu, token)`; route to the owner's pump |
 | completion counters | global boot state | per mdev, reset on session/rebind |
-| pump | first open mdev (`:13296-13308`) | per-mdev pump (or round-robin over all open mdevs) |
+| pump | first open mdev (`:13352-13364`) | per-mdev pump (or round-robin over all open mdevs) |
 
 The GMMU half of address-space separation is the page directory: each VA
 space has one, published by the guest through `SET_PAGE_DIRECTORY` with its
@@ -258,7 +260,7 @@ mdev's address space, and a completion event is posted only to the owning
 mdev's event object.
 
 Today the release path resolves the target VA through *global* tables
-(`svc_resolve_va`, `svc_sem_write`; `kernel/gsp_sema_service.c:2098,1514`)
+(`svc_resolve_va`, `svc_sem_write`; `kernel/gsp_sema_service.c:2098,2474`)
 and posts through `gsp_rm_post_channel_event()` on the emulation context
 (`kernel/gsp_rm_emulation.c:602`). The first is the cross-tenant hazard: a
 release record decoded from guest A's push buffer could resolve through a
@@ -581,8 +583,10 @@ The requested chain, end to end:
 
 ### 4.4 Design A — VA-subtree partitioning (no guest KMD change)
 
-This is the **stock-compatible** design and the one that can be prototyped
-inside the 1.0 programme. It relies on one idea: **the VA space is the
+This is the **stock-compatible** design and the research entry point: it is
+the only design that needs no guest KMD change, but its prototype is M6 —
+post-1.0, dual-gated, and it does not shape baseline 1.0 code (§7.4). It
+relies on one idea: **the VA space is the
 security domain, and a VA is self-describing because its prefix encodes its
 owner.**
 
@@ -1090,6 +1094,10 @@ starts after 1.0 goals are met, on an explicit human decision.
   CUDA reproducibility and per-client state issues M1 resolves;
   `../../debug/risc-v-gsp-rm-vm/docs/{43-GMMU-PTE-DECODER,44-GMMU-ORACLE-AND-WORKFLOW,23-RM610-READINESS}.md` —
   tooling and gates cited above.
-* Local analysis: `LOCAL-MULTI-TENANT-GMMU.md` (adjacent; part of the
-  local analysis) — provenance behind §4.2 and the unredacted design
-  reasoning.
+
+## Change log
+
+| Date | Change |
+|---|---|
+| 2026-10-08 | Created: multi-mdev service-state ownership rules, isolation-layer model, VRAM oversubscription design, paged-attention tenant/agent protection stack (Design A/B, three granularities), walked example, portability, M1–M8 roadmap. Tree `66388560`. |
+| 2026-10-08 | Review pass: status hash refreshed to `master @ 1f571dda`; drifted line anchors updated for the post-`66388560` code (pump loop, doorbell, `svc_sem_write`); the vEP vocabulary aligned with doc 13 (13 is the vocabulary authority, this document the GMMU-policy authority); Design A classified as the research entry point (M6), not a 1.0 programme item. |