M4: /sbin/init as PID 1 — a heartbeat process

init is now a real scheduled ring-3 process: it prints a heartbeat and
sleeps, forever. The kernel spawns it at boot via spawnProcess (its own
address space, preemption on) and the boot context drops to idle — the
system's steady state is "kernel idle, init alive in ring 3", beating
~1 Hz. Adds the sleep(ms) syscall. The init/process tests are reshaped
around the heartbeat (repeated syscalls, still-alive, two concurrent
processes on distinct address spaces). Pins init to LLD and folds the
.large code model's .ltext/.lrodata/.ldata into the linker script so its
code segment is R+X. Removes the now-dead borrowed-thread ELF loader
(runInitElf); spawnProcess is the one path. Docs updated. Suite 28/28.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/vision.md

@@ -81,16 +81,20 @@ prerequisites.
 (with boot-services memory reclaimed), [paging](paging.md) with W^X, [exceptions and
 interrupts](interrupts.md), a [calibrated timer + ns clock](device-interrupts.md), a
 [heap](heap.md), a [fixed-priority preemptive scheduler](scheduling.md) with blocking,
-in-kernel [IPC channels](ipc.md), SMP (all cores scheduling, with affinity), and
-**ring 3**: user GDT/TSS plumbing, U/S-bit mappings, an `int 0x80` syscall gate, and
-`/sbin/init` — a real user ELF built from `sbin/`, shipped on the boot volume, loaded
-by the kernel, run at CPL 3 — plus a [test harness](testing.md).
+in-kernel [IPC channels](ipc.md), SMP (all cores scheduling, with affinity), a
+**higher-half kernel** with a physmap, and **user space**: per-process address
+spaces, `syscall`/`sysret` with the `swapgs` discipline, a user-ELF loader, and
+`/sbin/init` — a real user ELF built from `sbin/`, running at CPL 3 as PID 1 on its
+own page tables — plus a [test harness](testing.md).
 
-- **Isolation track** — **user mode + address-space isolation** (higher-half kernel,
-  ring 3, per-process page tables). The substrate everything else needs. *In
-  progress: ring 3 + a loaded `/sbin/init` work (M1); next the higher-half move (M2),
-  then per-process address spaces + `syscall`/`sysret` + init as a real schedulable
-  process (M3), then ELF/initrd generalisation (M4).*
+- **Isolation track** — **user mode + address-space isolation**. *Done: a
+  higher-half kernel with a physmap (the low half is user space), per-process
+  address spaces with CR3 switched on context switch, the `swapgs` discipline,
+  `syscall`/`sysret`, a user-ELF loader, and `/sbin/init` running as a real
+  preemptive ring-3 process (PID 1). Remaining polish: an address-space/stack
+  reaper for exited tasks, SMAP + fault-recovering copy-in/out, the real IPC
+  syscalls (IPC_Call/IPC_ReplyWait — they arrive with the second user server),
+  and TLB shootdown once a process has more than one thread.*
 - **Resilience track** — fault → kill → notify, a supervisor/reincarnation server,
   resource cleanup on death, then a restartable driver as proof. Needs isolation.
   See [resilience.md](resilience.md).