docs(review): refresh vEP citations against merged master and reconcile GR completion with FORENSICS-grv5

Line anchors drifted when c33f6006 landed after the doc was written at
d0213b5a (svc_thread, svc_gr_request, svc_pending_add, the H3 guard, the
readiness gate). Also: the grv5 SEMA_DBG=Y campaign showed the notifier and
event wake-up do fire while the counter slot publication is the link that
never writes, so the document's 'completion wake-up' framing was stale in
the stage table, section 3.4, section 6.1, the challenges and the iteration
plan; refresh the status hash, the discovery-cadence wording and the
mode-matrix source note, and extend the change log.

1 files changed, 11 insertions, 8 deletions

diff --git a/wiki/Execution-Plane.md b/wiki/Execution-Plane.md
index 0f6eafe..5d1052f 100644
--- a/wiki/Execution-Plane.md
+++ b/wiki/Execution-Plane.md
@@ -8,7 +8,7 @@
 > when the two disagree, the docs tree wins. Front door:
 > [`../docs/README.md`](../docs/README.md).
 
-Status: 2026-10-08, tree `master @ 66388560`. Tags: `[live]` proven with the
+Status: 2026-10-08, tree `master @ 1f571dda`. Tags: `[live]` proven with the
 stock guest driver; `[gated]` implemented, default-off or parameter-gated;
 `[wip]` partial; `[wall]` current blocker; `[target]` named success latch;
 `[planned]` designed, not built.
@@ -104,7 +104,7 @@ guest: push + QMD + GPFIFO entry + doorbell (BAR0 0x88704)
    release; the host applies the deferred release exactly once, publishes the
    completion counter, clears the notifier and posts the channel event; MSI-X
    wakes the guest. CE work is live in this shape `[gated]`; for GR the
-   wake-up step is the current second face of the wall.
+   completion-counter publication is the current second face of the wall.
 
 ## 4. How work is found: discovery, truth, completion
 
@@ -134,11 +134,14 @@ guest: push + QMD + GPFIFO entry + doorbell (BAR0 0x88704)
   install is still not observed. The mode matrix carries dozens of
   single-variable falsifiers (promote shapes, prelude/PCAS form, local-memory
   block, lane controls, shadow windows, pointer relocation).
-* **Completion wake-up.** A boot where GR rings were discovered and releases
-  applied still saw the guest re-queue the same push and give up; the
-  best-supported reading is that the notifier/event wake-up never arrived.
-  The named one-variable experiment is a `sema_dbg` cycle to un-gate the
-  notifier/publish/event traces.
+* **Completion publication.** A boot where GR rings were discovered and
+  releases applied still saw the guest re-queue the same push and give up. A
+  later `sema_dbg=Y` run settled it: the release was written to the exact
+  slot, the notifier cleared and the event posted, while the completion
+  counter publication never wrote because the fixed-total autoreg mapping
+  makes it a structural no-op. The leading reading is the counter-slot
+  publication; the GP_GET write-back is the secondary, still-open candidate.
+  Both are debug-gated today.
 * **Reproducibility (ISSUE-0001).** The green/stall split is per-boot. The
   first fix wave landed and the earlier CE freeze is gone; the stall moved to
   GR ring discovery, which the latest discovery work addresses. Acceptance
@@ -162,7 +165,7 @@ human approval gate.
 ## 7. Future
 
 The planned next steps are reproducibility acceptance, the descriptor-install
-and wake-up investigations (offline-first with the RISC-V GSP-RM debugger
+and completion-publication investigations (offline-first with the RISC-V GSP-RM debugger
 where possible), the arbitrary-kernel acceptance suite, then the near-native
 performance program. The unsolved future classes — multi-tenant fairness,
 fault replay/cancel, context switching between tenants, hostile-guest