docs(review): fix GMMU-doc anchors and vEP vocabulary; index docs 13/14 in the READMEs

The GMMU doc cited pre-c33f6006 lines for the pump, doorbell and svc_sem_write,
defined vEP differently from doc 13 (which it names as the vocabulary
authority), and called Design A prototypable in the 1.0 programme while M6
classifies the same prototype as post-1.0 research. Fix all three, refresh
the status hash, and add the doc to the docs/ and wiki/ indexes with the
renumbered reading-order rows.

2 files changed, 42 insertions, 29 deletions

diff --git a/docs/03-architecture/14-multi-tenant-gmmu-protection.md b/docs/03-architecture/14-multi-tenant-gmmu-protection.md
index c3f58c7..060a600 100644
--- a/docs/03-architecture/14-multi-tenant-gmmu-protection.md
+++ b/docs/03-architecture/14-multi-tenant-gmmu-protection.md
@@ -1,6 +1,6 @@
 # Multi-Tenant GMMU Protection: Isolation Design and Paged-Attention Controls
 
-> **Status: design (2026-10-08, master `66388560`).** This document specifies
+> **Status: design (2026-10-08, master `1f571dda`).** This document specifies
 > how Open-IOV isolates multiple tenants — multiple mdevs *and* multiple
 > tenants inside one guest — at the GPU memory-management unit (GMMU), and how
 > a paged-attention inference stack (vLLM-style) can use those protections.
@@ -119,9 +119,9 @@ The **work/completion service is not**. `gsp_sema_service.c` holds one
 global `static struct sema_svc svc;` (`kernel/gsp_sema_service.c:676`), and:
 
 * the service thread pumps **the first open mdev it finds**
-  (`kernel/gsp_sema_service.c:13296-13308`);
+  (`kernel/gsp_sema_service.c:13352-13364`);
 * the work-submission doorbell carries no owner — `gsp_sema_service_doorbell(u32 token)`
-  (`kernel/gsp_sema_service.c:13456`), called from the VFIO write path with
+  (`kernel/gsp_sema_service.c:13512`), called from the VFIO write path with
   no mdev argument (`kernel/main.c:865`);
 * channel registrations are keyed by the guest-chosen `h_object` alone
   (`kernel/gsp_sema_service.c:847`, table bounded by `SVC_MAX_CHANNELS 128`
@@ -146,9 +146,11 @@ problem.** §2 fixes the ownership; §4 builds the GMMU policy on it.
 **Tenant** — isolation principal (`tenantId`): a VM/mdev at L0–L2, a logical
 serving principal inside a guest in §4. **Agent** — finest principal inside
 a tenant (`agentId`): a vLLM engine/worker, a CUDA context, a process.
-**vEP** — virtual execution plane: the per-instance mediator (guest
-emulation + work execution) for one mdev; see
-[`13-vexecution-plane.md`](13-vexecution-plane.md). **KV block** —
+**vEP** — the vGSP Execution Plane: the execution half of vGSP (guest work →
+physical execution → guest-visible completion), as defined in
+[`13-vexecution-plane.md`](13-vexecution-plane.md). This document's problem
+is that the vEP's work-service state is currently one global context rather
+than per-mdev. **KV block** —
 paged-attention cache page (vLLM `paged_attention_v2`: fixed-size blocks,
 one `block_tables` entry per logical block per sequence); a GPU allocation
 range, not a hardware object.
@@ -171,9 +173,9 @@ What exists and what changes:
 | `svc.chan[]` | keyed `h_object` (`gsp_sema_service.c:847`) | key `(vgpu, h_object)`; per-mdev lifetime reset |
 | `svc.vas[]` | keyed `h_vaspace` (`:988`) | key `(vgpu, h_vaspace)` |
 | learned VA→PA map / pins | keyed GPU VA (`:113-130`) | key `(vgpu, VA)`; per-mdev epoch |
-| doorbell token | ownerless (`:13456`, `main.c:865`) | `(vgpu, token)`; route to the owner's pump |
+| doorbell token | ownerless (`:13512`, `main.c:865`) | `(vgpu, token)`; route to the owner's pump |
 | completion counters | global boot state | per mdev, reset on session/rebind |
-| pump | first open mdev (`:13296-13308`) | per-mdev pump (or round-robin over all open mdevs) |
+| pump | first open mdev (`:13352-13364`) | per-mdev pump (or round-robin over all open mdevs) |
 
 The GMMU half of address-space separation is the page directory: each VA
 space has one, published by the guest through `SET_PAGE_DIRECTORY` with its
@@ -258,7 +260,7 @@ mdev's address space, and a completion event is posted only to the owning
 mdev's event object.
 
 Today the release path resolves the target VA through *global* tables
-(`svc_resolve_va`, `svc_sem_write`; `kernel/gsp_sema_service.c:2098,1514`)
+(`svc_resolve_va`, `svc_sem_write`; `kernel/gsp_sema_service.c:2098,2474`)
 and posts through `gsp_rm_post_channel_event()` on the emulation context
 (`kernel/gsp_rm_emulation.c:602`). The first is the cross-tenant hazard: a
 release record decoded from guest A's push buffer could resolve through a
@@ -581,8 +583,10 @@ The requested chain, end to end:
 
 ### 4.4 Design A — VA-subtree partitioning (no guest KMD change)
 
-This is the **stock-compatible** design and the one that can be prototyped
-inside the 1.0 programme. It relies on one idea: **the VA space is the
+This is the **stock-compatible** design and the research entry point: it is
+the only design that needs no guest KMD change, but its prototype is M6 —
+post-1.0, dual-gated, and it does not shape baseline 1.0 code (§7.4). It
+relies on one idea: **the VA space is the
 security domain, and a VA is self-describing because its prefix encodes its
 owner.**
 
@@ -1090,6 +1094,10 @@ starts after 1.0 goals are met, on an explicit human decision.
   CUDA reproducibility and per-client state issues M1 resolves;
   `../../debug/risc-v-gsp-rm-vm/docs/{43-GMMU-PTE-DECODER,44-GMMU-ORACLE-AND-WORKFLOW,23-RM610-READINESS}.md` —
   tooling and gates cited above.
-* Local analysis: `LOCAL-MULTI-TENANT-GMMU.md` (adjacent; part of the
-  local analysis) — provenance behind §4.2 and the unredacted design
-  reasoning.
+
+## Change log
+
+| Date | Change |
+|---|---|
+| 2026-10-08 | Created: multi-mdev service-state ownership rules, isolation-layer model, VRAM oversubscription design, paged-attention tenant/agent protection stack (Design A/B, three granularities), walked example, portability, M1–M8 roadmap. Tree `66388560`. |
+| 2026-10-08 | Review pass: status hash refreshed to `master @ 1f571dda`; drifted line anchors updated for the post-`66388560` code (pump loop, doorbell, `svc_sem_write`); the vEP vocabulary aligned with doc 13 (13 is the vocabulary authority, this document the GMMU-policy authority); Design A classified as the research entry point (M6), not a 1.0 programme item. |
diff --git a/docs/README.md b/docs/README.md
index fe39077..13f0ae5 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -173,20 +173,21 @@ Read in order if you are new. Jump directly if you know what you need.
 | 13 | [Physical GPU integration](03-architecture/08-physical-gpu-integration.md) | developers, architects | 20 min |
 | 14 | [Physical backend guest wiring](03-architecture/11-physical-backend-guest-wiring.md) | developers, architects | 25 min |
 | 15 | [The vGSP execution plane (vEP)](03-architecture/13-vexecution-plane.md) | developers, architects | 25 min |
-| 16 | [The execution frontier: the GR compute-launch chain](04-implementation/03-execution-frontier.md) | developers, debuggers | 15 min |
-| 17 | [Host VF acceleration — future goal (deferred)](03-architecture/12-host-vf-acceleration-future-goal.md) | architects, planners | 10 min |
-| 18 | [Known-knowns and known-unknowns](04-implementation/01-known-knowns-and-unknowns.md) | everyone technical | 25 min |
-| 19 | [Practical challenges and adversarial interoperability](04-implementation/02-practical-challenges-and-adversarial-interop.md) | developers, stakeholders | 20 min |
-| 20 | [Performance, correctness, security](05-operations/01-performance-correctness-security.md) | developers, auditors | 25 min |
-| 21 | [Debugging and maintenance workflows](05-operations/02-debugging-and-maintenance-workflows.md) | developers, maintainers | 25 min |
-| 22 | [GSP in a RISC-V VM (risc-v-gsp-rm-debugger, experimental)](05-operations/03-risc-v-gsp-rm-vm.md) — implemented, documented and tested ([audit](../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md); [value demos](../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)) | developers, analysts | 15 min |
-| 23 | [risc-v-gsp-rm-debugger user guide (experimental)](05-operations/04-risc-v-gsp-rm-debugger-user-guide.md) — implemented, documented and tested ([audit](../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md); [value demos](../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)) | developers, analysts | 15 min |
-| 24 | [Defensive Operations Runbook](RUNBOOK.md) | maintainers, operators | 20 min |
-| 25 | [Engineering operations](eng-ops.md) — tool admission and workflows (Part I) plus live physical-backend operations (Part II) | maintainers, developers | 20 min |
-| 26 | [Hardware and software matrix](06-portability/hardware-software-matrix.md) | developers, integrators | 20 min |
-| 27 | [Developer onboarding and standards](07-developers/onboarding-and-standards.md) | contributors | 20 min |
-| 28 | [HAAEEP and collaboration](08-ecosystem/haaeep-and-collaboration.md) | stakeholders, partners | 20 min |
-| 29 | [Glossary and FAQ](09-reference/glossary-and-faq.md) | everyone | reference |
+| 16 | [Multi-tenant GMMU protection](03-architecture/14-multi-tenant-gmmu-protection.md) | developers, architects, security reviewers | 25 min |
+| 17 | [The execution frontier: the GR compute-launch chain](04-implementation/03-execution-frontier.md) | developers, debuggers | 15 min |
+| 18 | [Host VF acceleration — future goal (deferred)](03-architecture/12-host-vf-acceleration-future-goal.md) | architects, planners | 10 min |
+| 19 | [Known-knowns and known-unknowns](04-implementation/01-known-knowns-and-unknowns.md) | everyone technical | 25 min |
+| 20 | [Practical challenges and adversarial interoperability](04-implementation/02-practical-challenges-and-adversarial-interop.md) | developers, stakeholders | 20 min |
+| 21 | [Performance, correctness, security](05-operations/01-performance-correctness-security.md) | developers, auditors | 25 min |
+| 22 | [Debugging and maintenance workflows](05-operations/02-debugging-and-maintenance-workflows.md) | developers, maintainers | 25 min |
+| 23 | [GSP in a RISC-V VM (risc-v-gsp-rm-debugger, experimental)](05-operations/03-risc-v-gsp-rm-vm.md) — implemented, documented and tested ([audit](../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md); [value demos](../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)) | developers, analysts | 15 min |
+| 24 | [risc-v-gsp-rm-debugger user guide (experimental)](05-operations/04-risc-v-gsp-rm-debugger-user-guide.md) — implemented, documented and tested ([audit](../debug/risc-v-gsp-rm-vm/docs/27-TOOL-AUDIT.md); [value demos](../debug/risc-v-gsp-rm-vm/docs/25-VALUE-VALIDATION.md)) | developers, analysts | 15 min |
+| 25 | [Defensive Operations Runbook](RUNBOOK.md) | maintainers, operators | 20 min |
+| 26 | [Engineering operations](eng-ops.md) — tool admission and workflows (Part I) plus live physical-backend operations (Part II) | maintainers, developers | 20 min |
+| 27 | [Hardware and software matrix](06-portability/hardware-software-matrix.md) | developers, integrators | 20 min |
+| 28 | [Developer onboarding and standards](07-developers/onboarding-and-standards.md) | contributors | 20 min |
+| 29 | [HAAEEP and collaboration](08-ecosystem/haaeep-and-collaboration.md) | stakeholders, partners | 20 min |
+| 30 | [Glossary and FAQ](09-reference/glossary-and-faq.md) | everyone | reference |
 
 <!-- change (2026-10-02): insert the risc-v-gsp-rm-debugger user guide and the Open-IOV
 Defensive Operations Runbook into the reading list; renumber rows 21-24 to
@@ -202,7 +203,11 @@ additive only. -->
 <!-- change (2026-10-08): insert "The vGSP execution plane (vEP)" as row 15
 (architecture: the work path); renumber rows 15-28 to 16-29; additive only. -->
 
-Row 17 is a **deferred future goal**: host NVIDIA-driver acceleration over a
+<!-- change (2026-10-08): insert "Multi-tenant GMMU protection" as row 16
+(architecture: isolation design, companion to the vEP doc); renumber rows
+16-29 to 17-30; additive only. -->
+
+Row 18 is a **deferred future goal**: host NVIDIA-driver acceleration over a
 virtual function. The feasibility verdict and a first design sketch are
 recorded there for planning; it is not on the active critical path (guest CUDA
 execution, multi-VM, 3D, performance come first).