docs: per-process logging + the kernel VFS root

logging.md rewritten around the pipeline (std.log -> leveled debug_write
-> tagged ring -> logger service -> /var/log/<boot-stamp>/<binary-path>.log),
why the buffer is a kernel ring rather than a logging server (the
storage stack must log; early boot needs the buffer anyway), the
announce-once and counted-loss disciplines, and the accepted gaps.
vfs-protocol.md: the router is the kernel (fs_resolve names, backends
serve data); endpoint comes from resolve, not a registry lookup; mount/
unmount retired from the wire; the rewrite-prefix mount semantics.
vdso.md: klog_status + the fs naming calls join the future table; the
no-file-I/O line sharpened (kernel resolves names, never blocks on a
filesystem). syscall.md: the placeholder status blurb replaced with the
real call families.

docs/vfs-protocol.md

@@ -1,20 +1,24 @@
 # The VFS wire protocol
 
 > **Status:** built and spoken today between `runtime.fs` (the client) and the
-> VFS server (`system/services/vfs`), with mounted backends (the FAT server)
-> speaking the same protocol behind the router. The Zig source of truth is
-> `system/services/vfs/protocol.zig` (the `vfs-protocol` module), whose unit
-> tests pin the sizes and values below. This page is the **language-neutral
-> wire specification** of that contract — what a Rust or C client implements
-> ([vdso.md](vdso.md) explains why the IPC protocols, not the syscall
-> numbers, are danos's public ABI).
+> filesystem BACKENDS (the FAT server). The mount router lives in the
+> **kernel** (`system/kernel/vfs.zig`): `fs_resolve` routes a path and either
+> serves it directly (the read-only /system initrd mount, via `fs_node`) or
+> redirects the caller to the owning backend's endpoint plus the rewritten
+> mount-relative path — after which the client speaks THIS protocol to the
+> backend, unchanged. The Zig source of truth is `system/vfs-protocol.zig`
+> (the `vfs-protocol` module), whose unit tests pin the sizes and values
+> below. This page is the **language-neutral wire specification** of that
+> contract — what a Rust or C client implements ([vdso.md](vdso.md) explains
+> why the IPC protocols, not the syscall numbers, are danos's public ABI).
 
 ## Transport
 
 A VFS exchange is one synchronous IPC rendezvous (`ipc_call`,
 docs/ipc.md): the client sends one message and blocks; the server replies
-with one message. The endpoint is found by well-known service id
-(`ipc_lookup`, service id **1** = vfs).
+with one message. The endpoint comes from the kernel's `fs_resolve` — which
+also hands back the path rewritten relative to the mount — not from a
+registry lookup. (Service id 1, the old userspace router, is retired.)
 
 - A message is at most **256 bytes** (`message_maximum`).
 - A request is a fixed 32-byte **Request** header followed by an inline
@@ -26,8 +30,11 @@ with one message. The endpoint is found by well-known service id
 - All integers are **little-endian**; layouts are C layout for x86-64
   (`extern struct`), offsets given below so nothing need be inferred.
 
-The kernel never parses any of this — it only moves the bytes
-(docs/syscall.md); files are entirely a user-space affair.
+The kernel resolves NAMES (the mount table) but never parses these
+messages — it moves the bytes; file state is entirely the backend's affair.
+With clients holding backend node ids directly, a backend records each open
+handle's owner and sweeps a dead client's handles via the published process
+exit events.
 
 ## Request header — 32 bytes
 
@@ -90,13 +97,14 @@ Notes per operation:
   position. Each call returns exactly one entry; the client increments the
   cursor by 1. A reply with `len` 0 is end-of-directory. The directory must
   have been opened with the `directory` flag.
-- **mount** — the one operation that passes a **capability**: the caller
-  (a filesystem server, e.g. FAT) sends its own request endpoint as the
-  `ipc_call` capability argument, and the router forwards everything under
-  the mount point to it — speaking this same protocol, with paths rewritten
-  relative to the mount. Prefixes match at path boundaries only
-  (`/mnt/usb` never captures `/mnt/usbextra`); the longest matching prefix
-  wins.
+- **mount / unmount** — RETIRED from the wire: mounting is the `fs_mount`
+  syscall now (a filesystem server passes its endpoint handle; possession is
+  the capability, exactly the trust of the old cap-passing op). The op
+  numbers stay reserved. Mount-prefix semantics are unchanged: prefixes
+  match at path boundaries only (`/mnt/usb` never captures `/mnt/usbextra`),
+  the longest matching prefix wins, and an optional backend-side rewrite
+  prefix maps a mount into the backend's namespace (fat serves `/mnt/usb`
+  from its volume root and `/var` from its `/var` subtree).
 - **rename** — same-directory rename only (the router requires old and new to
   resolve under one mount).