1 files changed, 5 insertions, 6 deletions
diff --git a/debug/risc-v-gsp-rm-vm/docs/11-GSP-RM-SERVICE-DEVELOPER-GUIDE.md b/debug/risc-v-gsp-rm-vm/docs/11-GSP-RM-SERVICE-DEVELOPER-GUIDE.md
index db5109c..2022cf1 100644
--- a/debug/risc-v-gsp-rm-vm/docs/11-GSP-RM-SERVICE-DEVELOPER-GUIDE.md
+++ b/debug/risc-v-gsp-rm-vm/docs/11-GSP-RM-SERVICE-DEVELOPER-GUIDE.md
@@ -1,8 +1,7 @@
 # 11 — GSP RM firmware service developer guide
 
-> **# TOOL IN DEVELOPMENT - NOT READY YET!** See 00 for status and 06 for the
-> fidelity caveats. Exact proprietary API names are not reproduced in tracked
-> docs; local provenance lives in the local analysis notes.
+> Status: implemented, documented and tested (audit: docs/27-TOOL-AUDIT.md; value demos: docs/25-VALUE-VALIDATION.md).
+> See [06-ACCURACY](06-ACCURACY.md) for the fidelity caveats.
 
 ## 1. What this guide is for
 
@@ -130,12 +129,12 @@ prototype is analysed exactly like firmware code.
 2. **Integration run:** `invoke_via_firmware` with the mailbox path, while
    hooks on the firmware's dispatcher and watchpoints on the control block
    record the full route.
-3. **Ghidra-driven:** `greeneye ghidra` + `GreenEyeControl.java` — execute
+3. **Ghidra-driven:** `./risc-v-gsp-rm-debugger.sh ghidra` + `GreenEyeControl.java` — execute
    until a service address, set breakpoints from the decompiler, read
    registers/memory, export hits (docs/13).
 4. **Coverage:** run with the TCG plugin filtered to the service load range
-   (`qemu/greeneye-trace.c`, `start=`/`end=` args) to see every access.
-5. **Regression:** record a session per command; `greeneye compare` detects
+   (`qemu/greeneye_trace.c`, `start=`/`end=` args) to see every access.
+5. **Regression:** record a session per command; `./risc-v-gsp-rm-debugger.sh compare` detects
    changed hit/watch/write profiles when the service or firmware changes.
 
 ## 8. Rules and pitfalls