init: /protocol replaces the ServiceId registry

A protocol is reached by name now, not by a compile-time integer. Init is
PID 1 and already knows which binary it started, so init serves /protocol
as a vfs backend: bind claims a contract with the provider's endpoint
attached, open answers with that endpoint as the reply's capability, and
readdir lists what is bound with the task and binary behind it. The kernel
reserves the prefix — nothing may mount over it, under it, or unmount it —
and ServiceId, ipc_register and ipc_lookup are gone, their syscall numbers
left vacant.

A bind is authorized by who the caller *is*: the kernel-stamped binary
together with the supervising task's identity, matched against
/system/configuration/protocol.csv. Identity, not spelling — spawn is
ungated, so an attacker can run any bundled binary, and a name-only rule
would have let it launder grants through an init of its own making. A name
a live process holds is refused to everyone else; a dead one's is released.

Three review rounds against a hostile ring-3 process found what 108 green
tests could not, because the suite contains no attacker. Publishing init's
supervision endpoint as the registry put PID 1's mailbox in every process's
hands, where two forged bytes reached the shutdown path: privileged traffic
is now believed only from the task that holds the contract it speaks for.
A capability arriving on a request outlived every path that ignored it,
one handle per call until the table was full — in init, and in the harness
ten services share — so the arriving capability is owned by the turn and
released unless a handler says otherwise. And the kernel let anyone holding
an endpoint handle aim signals, timers, exit notices and interrupts at it:
binding now requires having created it.

Suite 108/108. The new protocol-registry case asserts eleven properties,
each one an attack that must fail.

library/protocol/envelope/envelope.zig

@@ -119,6 +119,15 @@ pub fn fitsPost(comptime T: type) bool {
 /// Positive here, sent negated in `Status.status`, as the kernel spells it.
 pub const ENOSYS: i32 = 10; // this protocol has no such operation
 pub const EPROTO: i32 = 11; // malformed packet: shorter than the verb it names
+pub const EBUSY: i32 = 12; // the thing asked for is held by someone still alive
+
+/// Restated from the kernel's half of the numbering, because a provider refuses
+/// too and userspace has no other place to read these from: `ENOENT` is "no such
+/// name", `EPERM` "not permitted". The protocol registry answers an ungranted
+/// bind with the second and a name a live provider already holds with `EBUSY`.
+pub const ENOENT: i32 = 4;
+pub const ENOSPC: i32 = 5;
+pub const EPERM: i32 = 9;
 
 // --- framing ----------------------------------------------------------------
 

library/protocol/power/power-protocol.zig

@@ -1,7 +1,9 @@
 //! The power protocol (docs/power.md): system power's domain-named surface,
-//! registered under `ServiceId.power`. On x86 the acpi service serves it; on
-//! ARM a PSCI/mailbox service will register the same id — subscribers never
-//! learn which firmware they are on (docs/discovery.md — firmware neutrality).
+//! bound at `/protocol/power`. On x86 the acpi service provides it; on ARM a
+//! PSCI/mailbox service will bind the same name — subscribers never learn which
+//! firmware they are on (docs/discovery.md — firmware neutrality), which is the
+//! whole point of naming the contract rather than the provider
+//! (docs/os-development/protocol-namespace.md).
 //! The vfs-protocol pattern: extern-struct messages, a version, reserved fields.
 
 /// The protocol version a client states nowhere yet — reserved for the day a

library/protocol/vfs/vfs-protocol.zig

@@ -40,6 +40,12 @@ pub const Operation = enum(u32) {
     // rename: the payload is the old path, a single 0x00 separator, then the new
     // path. Same-directory rename only (the router requires both under one mount).
     rename, // rename(old\0new payload) -> status
+    // Appended for the protocol namespace (P2). The registry is a synthetic
+    // backend mounted at /protocol: `open` establishes a channel and `readdir`
+    // lists the bound names like any directory, so those two verbs need nothing
+    // new — but *claiming* a name does. A file backend refuses it, alongside the
+    // router verbs it does not implement either; only the registry implements it.
+    bind, // bind(name payload, capability = the provider's endpoint) -> status
 };
 
 /// The type of a filesystem node, aligned to the node-kind table
@@ -132,4 +138,7 @@ test "protocol struct sizes and node kinds" {
     try std.testing.expectEqual(@as(u32, 0), @intFromEnum(Operation.open));
     try std.testing.expectEqual(@as(u32, 4), @intFromEnum(Operation.status));
     try std.testing.expectEqual(@as(u32, 5), @intFromEnum(Operation.readdir));
+    try std.testing.expectEqual(@as(u32, 10), @intFromEnum(Operation.rename));
+    // The registry's claim verb, appended last with the protocol namespace.
+    try std.testing.expectEqual(@as(u32, 11), @intFromEnum(Operation.bind));
 }