debug: risc-v-gsp-rm-debugger final pass - remove in-development notices, complete rename, adversarial-review fixes

Remove the '# TOOL IN DEVELOPMENT - NOT READY YET!' notices from the tool docs/README/scripts and the project docs; record the removal (2026-10-02) against the tool audit (debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md), the 194-test suite and the value-validation demos (docs/25-VALUE-VALIDATION.md).

Complete the cosmetic rename to risc-v-gsp-rm-debugger in user-facing prose and commands (launcher, roadmap, docs); internal greeneye package and code identifiers unchanged.

Adversarial-review fixes: deterministic control-discovery sweep (flaky test root-caused), UUID session dirs + atomic JSON writes for concurrent runs, Ghidra bridge loopback enforcement and clean shutdown, fp register restore in Session.call, version_diff --dry-run, 30 s interrupt budget, dry-run non-destructiveness verified.

Docs: flag-removal records, link fixes, command/flag corrections (fdematch arity, port_new_device --out, trace filename), F2 orchestration note in future-eng-ops; STATE-CURRENT status refreshed.

1 files changed, 11 insertions, 10 deletions

diff --git a/docs/05-operations/04-risc-v-gsp-rm-debugger-user-guide.md b/docs/05-operations/04-risc-v-gsp-rm-debugger-user-guide.md
index f12230a..c1ecffe 100644
--- a/docs/05-operations/04-risc-v-gsp-rm-debugger-user-guide.md
+++ b/docs/05-operations/04-risc-v-gsp-rm-debugger-user-guide.md
@@ -1,6 +1,6 @@
 # risc-v-gsp-rm-debugger User Guide (experimental)
 
-> **# TOOL IN DEVELOPMENT - NOT READY YET!**
+> Status: implemented, documented and tested (audit: [docs/27](../../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md); value demos: [docs/25](../../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)).
 > risc-v-gsp-rm-debugger is the development environment for running GSP/uproc firmware
 > off-hardware, observing it, injecting into it and comparing runs as evidence.
 > It is never shipped, never a driver dependency and never present in a guest;
@@ -122,7 +122,7 @@ security claims.
 Every run records a `greeneye-session/1` directory:
 
 ```text
-dumps/<stamp>-<name>/
+dumps/<stamp>-<uuid>-<name>/
   session.json        format, name, counts, snapshot inventory, meta
   events.jsonl        append-only event stream (hooks, watches, memory, notes)
   snapshots/*.bin.z   zlib-compressed region captures with sha256
@@ -181,7 +181,7 @@ Run everything from `open-iov/debug/risc-v-gsp-rm-vm/` unless stated.
 | `plugins/rmharness_plugin.py` | REPL commands for the host RM oracle |
 | `rmharness/harness.sh` + `rmtool`/`rmtop`/`rmq` | read-only host oracle captures appended into a session |
 | `ghidra/ExportForGreenEye.java`, `MarkGreenEyeHits.java`, `GreenEyeControl.java` | symbol export, hit annotation and decompiler-driven execution |
-| `sdk/` + `greeneye inject` | position-independent service ABI v1 |
+| `sdk/` + `./risc-v-gsp-rm-debugger.sh inject` | position-independent service ABI v1 |
 
 ## 5. Choosing the right tool
 
@@ -342,17 +342,18 @@ python3 -m greeneye.device_map show dumps/<ver>-device-map.json
 | `NameError: __file__` in `run` scripts | script invoked outside `risc-v-gsp-rm-debugger.sh run` | run through `./risc-v-gsp-rm-debugger.sh run`, keep scripts inside the tool tree |
 | Empty TCG trace blob | plugin window missed or target never resumed | `make -C qemu`; widen `start=`/`end=`, set `exec=on`, resume the target |
 | MCP writes refused / no tools | server read-only by default; stdout polluted | pass `--allow-write`/`--allow-inject` deliberately; keep stdout protocol-only |
-| `greeneye error:` on a valid path | wrong relative path or `--db` file | `./risc-v-gsp-rm-debugger.sh info` shows resolved paths; bad symbol DBs fail with a clear error |
+| `risc-v-gsp-rm-debugger error:` on a valid path | wrong relative path or `--db` file | `./risc-v-gsp-rm-debugger.sh info` shows resolved paths; bad symbol DBs fail with a clear error |
 | Harness findings not reproducible | seed/budget changed | pin `--seed` and budgets; compare `findings.jsonl` byte-for-byte |
 | Everything "unreachable" | wrong surface/timeouts | run `--surface demo` on the built demo first; raise `--settle`/`--timeout` |
 | `Unknown symbol` in the optional OpenRM build | module-tag drift | re-pin build glue; see the [RUNBOOK](../RUNBOOK.md) S2 |
 
-Marker status: every tool document carries the
-**# TOOL IN DEVELOPMENT - NOT READY YET!** banner. The marker is removed only
-when the acceptance list in
-[docs/00-OVERVIEW](../../debug/risc-v-gsp-rm-vm/docs/00-OVERVIEW.md) passes on a
-clean checkout, the usage recipes verify end-to-end, a second person can run
-the quickstart unaided, and the session format and CLI are declared stable.
+Marker status: the in-development notices were removed on 2026-10-02 after the
+tool audit ([docs/27](../../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md)), the
+194-test green suite, and the end-to-end s01–s10 value demonstrations
+([docs/25](../../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)). Open
+items stay listed honestly: docs 28/29 are unadmitted pilots and the device
+model/custom simulator M2+ remain roadmap. The session format and CLI are the
+audited v0.1 surfaces; treat changes to them as reviewed events.
 
 ## 9. Safety