init: /protocol replaces the ServiceId registry

A protocol is reached by name now, not by a compile-time integer. Init is
PID 1 and already knows which binary it started, so init serves /protocol
as a vfs backend: bind claims a contract with the provider's endpoint
attached, open answers with that endpoint as the reply's capability, and
readdir lists what is bound with the task and binary behind it. The kernel
reserves the prefix — nothing may mount over it, under it, or unmount it —
and ServiceId, ipc_register and ipc_lookup are gone, their syscall numbers
left vacant.

A bind is authorized by who the caller *is*: the kernel-stamped binary
together with the supervising task's identity, matched against
/system/configuration/protocol.csv. Identity, not spelling — spawn is
ungated, so an attacker can run any bundled binary, and a name-only rule
would have let it launder grants through an init of its own making. A name
a live process holds is refused to everyone else; a dead one's is released.

Three review rounds against a hostile ring-3 process found what 108 green
tests could not, because the suite contains no attacker. Publishing init's
supervision endpoint as the registry put PID 1's mailbox in every process's
hands, where two forged bytes reached the shutdown path: privileged traffic
is now believed only from the task that holds the contract it speaks for.
A capability arriving on a request outlived every path that ignored it,
one handle per call until the table was full — in init, and in the harness
ten services share — so the arriving capability is owned by the turn and
released unless a handler says otherwise. And the kernel let anyone holding
an endpoint handle aim signals, timers, exit notices and interrupts at it:
binding now requires having created it.

Suite 108/108. The new protocol-registry case asserts eleven properties,
each one an attack that must fail.

system/services/display/display.zig

@@ -16,6 +16,7 @@
 //! (docs/display-v2.md).
 
 const std = @import("std");
+const channel = @import("channel");
 const ipc = @import("ipc");
 const input = @import("input-client");
 const Thread = @import("thread").Thread;
@@ -307,11 +308,17 @@ fn verifyNativePresent() void {
 /// present channel, switch the backend to virtio-gpu, and queue a full-screen repaint. The
 /// present is deferred to a timer (see `service_endpoint`) so it happens after this reply
 /// unblocks the driver and it starts serving `.scanout`.
-fn attachScanout(stride: u32, width: u32, height: u32, format: u32, refresh_hz: u32, capability: ?ipc.Handle, reply: []u8) usize {
-    const cap = capability orelse return fail(reply);
+/// The surface arrives as the call's capability, and the harness's ownership rule
+/// applies: nothing here claims it, so the turn closes it on every path. Safe
+/// because a **mapping holds its own kernel reference** (system/kernel/process.zig
+/// `systemSharedMemoryMap`) — the pixels stay ours after the handle naming them
+/// goes, and a driver that dies and re-announces no longer costs a handle slot
+/// per restart.
+fn attachScanout(stride: u32, width: u32, height: u32, format: u32, refresh_hz: u32, arrived: *ipc.Arrival, reply: []u8) usize {
+    const cap = arrived.peek() orelse return fail(reply);
     if (width == 0 or height == 0 or stride < width) return fail(reply);
     const mapped = memory.sharedMap(cap) orelse return fail(reply);
-    const scanout = ipc.lookup(.scanout) orelse return fail(reply);
+    const scanout = channel.openEndpoint("scanout") orelse return fail(reply);
     // A second announce means the driver died and was restarted (V6): re-attach to its fresh
     // scanout. (The previous shared mapping leaks — there is no shared_memory_unmap syscall yet — but the
     // frames are the dead driver's, reclaimed on its exit; a handful across a crash is benign.)
@@ -506,10 +513,13 @@ fn mouseListener(width: u32, height: u32) void {
         return;
     };
     // Our own handle to the compositor's endpoint. IPC handles are per-thread, so we
-    // cannot reuse the main thread's service handle — we look the service up to install a
-    // handle in this thread's table. A poke posted here wakes the compositor loop parked
-    // in replyWait (docs/threading.md: handles do not cross threads).
-    cursor_channel.poke_endpoint = ipc.lookup(.display) orelse {
+    // cannot reuse the main thread's — this thread resolves and opens
+    // `/protocol/display` exactly like any other client would, once at startup, and
+    // gets its own handle. There is no special mechanism for reaching yourself: the
+    // registry does not know or care that the provider is this process. A poke posted
+    // here wakes the compositor loop parked in replyWait (docs/threading.md: handles
+    // do not cross threads).
+    cursor_channel.poke_endpoint = channel.openEndpoint("display") orelse {
         _ = logging.write("display: mouse listener could not reach the compositor endpoint\n");
         return;
     };
@@ -613,7 +623,7 @@ fn fail(reply: []u8) usize {
     return writeReply(reply, .{ .status = -1 });
 }
 
-fn onMessage(message: []const u8, reply: []u8, sender: u32, capability: ?ipc.Handle) usize {
+fn onMessage(message: []const u8, reply: []u8, sender: u32, arrived: *ipc.Arrival) usize {
     _ = sender;
     if (message.len < display_protocol.request_size) return fail(reply);
     const request = std.mem.bytesToValue(display_protocol.Request, message[0..display_protocol.request_size]);
@@ -657,7 +667,7 @@ fn onMessage(message: []const u8, reply: []u8, sender: u32, capability: ?ipc.Han
             return ok(reply);
         },
         @intFromEnum(display_protocol.Operation.attach_scanout) => {
-            return attachScanout(request.x, request.width, request.height, request.colour, request.y, capability, reply);
+            return attachScanout(request.x, request.width, request.height, request.colour, request.y, arrived, reply);
         },
         @intFromEnum(display_protocol.Operation.set_mode) => {
             if (!backend.setMode(request.width, request.height)) return fail(reply);
@@ -696,7 +706,7 @@ fn onNotification(badge: u64) void {
 
 pub fn main() void {
     service.run(display_protocol.message_maximum, .{
-        .service = .display,
+        .service = "display",
         .init = initialise,
         .on_message = onMessage,
         .on_notification = onNotification,