build: the unix paths retire — configuration, logs, and volumes move into the danos tree

/etc/init.csv and /etc/devices.csv become /system/configuration/*.csv (the
repo's etc/ moves to system/configuration/, mirroring the runtime tree),
/var/log becomes /system/logs, and /mnt/usb becomes /volumes/usb. The
kernel VFS gains a carve-out so FAT may serve exactly /system/configuration
and /system/logs beneath the initrd-backed /system while /system and /test
themselves stay unshadowable; FAT's single /var mount splits into those two
rewritten mounts. The kvfs readdir check learns /system's third child and
the ramdisk spawn sweep skips the configuration tree.

Suite 106/106.

system/abi.zig

@@ -295,7 +295,7 @@ pub const ServiceId = enum(u32) {
     power = 5, // system power: events (button, lid, battery) + shutdown (docs/power.md; domain-named per docs/discovery.md — the acpi service registers it on x86, a PSCI service will on ARM)
     usb_bus = 6, // the xHCI host-controller driver's transfer endpoint; USB class drivers look it up and `callCap`-open their device to get a private per-device transfer channel (docs/driver-model.md)
     block = 7, // a block-device driver (USB mass storage today): read/write of fixed-size blocks, the storage a filesystem sits on
-    fat = 8, // the FAT filesystem server; the VFS mounts it and forwards paths under its mount point (/mnt/usb) to it
+    fat = 8, // the FAT filesystem server; the VFS mounts it and forwards paths under its mount point (/volumes/usb) to it
     display = 9, // the display service: owns the framebuffer, composites a layer stack, presents frames (docs/display.md)
     shared_memory_test = 10, // the shared-memory test server (V2): a client passes it a shared-memory capability, it maps + verifies (docs/display-v2.md)
     scanout = 11, // a native scanout driver (virtio-gpu): the compositor finds it here to upgrade off the GOP framebuffer (docs/display-v2.md)

system/configuration/devices.csv

@@ -0,0 +1,33 @@
+# /system/configuration/devices.csv — the device→driver registry.
+#
+# The device manager reads this at boot and binds each device a bus driver
+# reports to the driver named here. It is AUTHORITATIVE: a device that no row
+# matches goes unbound (logged), never guessed. Edit this file to teach the
+# system new hardware — no recompile of the device manager required.
+#
+# One rule per line, nine comma-separated fields. '#' starts a comment
+# (whole-line or trailing); blank lines are ignored. Whitespace around a field
+# is trimmed, so columns may be padded for readability.
+#
+#   bus      which bus reported the device: pci | usb | acpi
+#   base     PCI base class  / USB class          (hex)
+#   class    PCI subclass    / USB subclass        (hex)
+#   prog_if  PCI prog-IF     / USB protocol         (hex)
+#   vendor   PCI vendor id   / USB idVendor          (hex)
+#   device   PCI device id   / USB idProduct          (hex)
+#   subsystem PCI subsystem, packed (ssvid<<16)|ssid   (hex)
+#   hid      ACPI _HID string (e.g. PNP0303); blank for pci/usb
+#   driver   full ramdisk path of the driver to spawn
+#
+# '*' or an empty field is a wildcard. When several rows match one device the
+# MOST SPECIFIC wins (pinning vendor/device/hid beats pinning only a class), so
+# a generic class rule and a precise vendor:device rule can coexist.
+#
+# bus   base class prog_if vendor device subsystem hid       driver
+pci,    0C,  03,   30,     *,     *,     *,        *,        /system/drivers/usb-xhci-bus
+pci,    03,  80,   *,      1AF4,  1050,  *,        *,        /system/drivers/virtio-gpu
+usb,    03,  01,   01,     *,     *,     *,        *,        /system/drivers/usb-hid-keyboard
+usb,    03,  01,   02,     *,     *,     *,        *,        /system/drivers/usb-hid-mouse
+usb,    08,  06,   50,     *,     *,     *,        *,        /system/drivers/usb-storage
+acpi,   *,   *,    *,      *,     *,     *,        PNP0303,  /system/drivers/ps2-bus
+acpi,   *,   *,    *,      *,     *,     *,        PNP0F13,  /system/drivers/ps2-bus

system/configuration/init-diagnose.csv

@@ -0,0 +1,13 @@
+# /system/configuration/init.csv — diagnose variant (-Ddiagnose), bundled at
+# /system/configuration/init.csv.
+#
+# The display stack (display, display-demo) is omitted so the kernel's timestamped
+# on-screen boot transcript is never suppressed — the bring-up timeline (USB,
+# storage, logger) stays readable on real hardware with no serial. See
+# system/configuration/init.csv for the format; this file must otherwise track it.
+#
+# service                          args...
+/system/services/input
+/system/services/device-manager
+/system/services/fat
+/system/services/logger

system/configuration/init.csv

@@ -0,0 +1,20 @@
+# /system/configuration/init.csv — the services init (PID 1) starts at boot, in order.
+#
+# init reads this at startup and spawns each service supervised (restarting it on
+# a crash, up to a cap). Startup order is top->bottom; shutdown is the reverse, so
+# the logger (last) goes down first and its final drain still has the fat server
+# and the whole storage chain alive underneath it. It is AUTHORITATIVE — there is
+# no hardcoded fallback list; a missing file means no services are started.
+#
+# '#' starts a comment (whole-line or trailing); blank lines are ignored. The
+# first field is the service binary path; any fields after it are the service's
+# argv. Drivers are absent on purpose — the device manager discovers hardware and
+# spawns those (see /system/configuration/devices.csv).
+#
+# service                          args...
+/system/services/input
+/system/services/device-manager
+/system/services/fat
+/system/services/display
+/system/services/display-demo
+/system/services/logger

system/drivers/pci-bus/pci-bus.zig

@@ -21,7 +21,7 @@ const logging = @import("logging");
 const device_manager_protocol = @import("device-manager-protocol");
 const pci_class = @import("pci-class");
 
-/// Log a discovered function as its would-be /etc/devices.csv columns (bus, base,
+/// Log a discovered function as its would-be /system/configuration/devices.csv columns (bus, base,
 /// class, prog_if, vendor, device, subsystem) followed by the human-readable
 /// class/subclass/prog-IF names — so a row for a new driver reads straight off the
 /// boot log. `subsystem` prints as `*` when the function has none, matching the CSV
@@ -154,7 +154,7 @@ fn registerAndReport(bus: u64, dev: u64, function: u64, class_triple: u32) void
     descriptor.class = @intFromEnum(device.DeviceClass.pci_device);
     descriptor.pci_class = class_triple;
     // Vendor/device from the first config dword (0x00): low half vendor, high half
-    // device. These carry to the manager's /etc/devices.csv matcher so a function
+    // device. These carry to the manager's /system/configuration/devices.csv matcher so a function
     // can bind on its exact 1AF4:1050 identity, not just its class triple.
     const vendor_device = configRead(bus, dev, function, 0x00);
     descriptor.vendor = @truncate(vendor_device);

system/drivers/usb-xhci-bus/usb-xhci-bus.zig

@@ -459,7 +459,7 @@ fn reportInterface(manager: ipc.Handle, port: u32, interface: library.InterfaceI
         return null;
     };
     // The devices.csv columns (bus=usb, and the class triple as base/class/prog_if)
-    // then the human-readable interface name — a would-be /etc/devices.csv row read
+    // then the human-readable interface name — a would-be /system/configuration/devices.csv row read
     // straight off the boot log.
     std.log.info("port {d} interface {d}  bus=usb base={X:0>2} class={X:0>2} prog_if={X:0>2}  —  {s}  registered as device {d}", .{
         port,

system/drivers/virtio-gpu/virtio-gpu.zig

@@ -205,7 +205,7 @@ fn initialise(endpoint: ipc.Handle) bool {
         return false;
     };
 
-    // Config space is resource 0. The registry (/etc/devices.csv) bound this driver by the
+    // Config space is resource 0. The registry (/system/configuration/devices.csv) bound this driver by the
     // exact virtio-gpu identity (vendor 0x1AF4 / device 0x1050), so there is no re-confirm to
     // do here any more — map config space and enable memory-space decode + bus mastering (the
     // device DMAs the ring and backing out of RAM; pci-bus only preserves whatever the firmware

system/kernel/log-ring.zig

@@ -161,7 +161,7 @@ test "append/read round trip" {
     defer std.testing.allocator.destroy(ring);
     ring.* = .{};
 
-    _ = ring.append(7, "/system/services/fat", .info, 123, "mounted /mnt/usb", false);
+    _ = ring.append(7, "/system/services/fat", .info, 123, "mounted /volumes/usb", false);
     _ = ring.append(0, "kernel", .raw, 456, "wall clock online", false);
 
     const first = parseAt(ring, ring.tail);
@@ -169,7 +169,7 @@ test "append/read round trip" {
     try std.testing.expectEqual(abi.KlogLevel.info, first.header.level);
     try std.testing.expectEqual(@as(u64, 123), first.header.timestamp_ns);
     try std.testing.expectEqualStrings("/system/services/fat", first.nameSlice());
-    try std.testing.expectEqualStrings("mounted /mnt/usb", first.messageSlice());
+    try std.testing.expectEqualStrings("mounted /volumes/usb", first.messageSlice());
 
     const second = parseAt(ring, first.next(ring.tail));
     try std.testing.expectEqual(@as(u32, 0), second.header.pid);

system/kernel/tests.zig

@@ -1970,7 +1970,7 @@ fn initTest(boot_information: *const BootInformation) void {
     check("init loaded and spawned as a process", spawned);
 
     // Wait (real time) until the LAST write is a heartbeat — proving init got
-    // through its boot chatter (heap ok, the /etc/init.csv lookup) and settled
+    // through its boot chatter (heap ok, the /system/configuration/init.csv lookup) and settled
     // into its beat-and-sleep loop (~1 s between beats). Waiting on the text
     // rather than a raw write count: the boot chatter alone satisfies a count,
     // which is exactly the too-early check that used to fail here.
@@ -2220,7 +2220,7 @@ fn vfsClientDeathTest(boot_information: *const BootInformation) void {
     };
 
     process.write_count = 0;
-    // The full tree: the storage chain must come up for /mnt/usb to exist —
+    // The full tree: the storage chain must come up for /volumes/usb to exist —
     // the fat server (not a router) now owns client file state and its sweep.
     process.setInitialRamdisk(image);
     const init_ok = if (process.spawnBundled("/system/services/init")) true else |_| false;
@@ -2606,7 +2606,7 @@ fn usbStorageTest(boot_information: *const BootInformation) void {
 
 /// The FAT mount chain: boot the full tree (init spawns the fat server, which
 /// brings up the USB storage chain, mounts the FAT volume, and mounts itself into
-/// the VFS at /mnt/usb), then spawn a fat-test client that lists and reads through
+/// the VFS at /volumes/usb), then spawn a fat-test client that lists and reads through
 /// the mount. The harness attaches a usb-storage device; the expect regex requires
 /// the fat mount and the client's success.
 fn fatMountTest(boot_information: *const BootInformation) void {
@@ -2801,11 +2801,13 @@ fn initialRamdiskTest(boot_information: *const BootInformation) void {
     var i: u32 = 0;
     while (i < rd.count) : (i += 1) {
         const item = rd.entry(i) orelse continue;
-        // The FHS boot tree ferries data files too (/etc/devices.csv,
-        // /etc/init.csv — served read-only by the kernel VFS, never spawned);
-        // only the /system and /test trees hold programs, so only those count
-        // toward the spawn-everything sweep.
-        const is_program = std.mem.startsWith(u8, item.name, "/system/") or
+        // The boot tree ferries data files too (/system/configuration/devices.csv,
+        // /system/configuration/init.csv — served read-only by the kernel VFS,
+        // never spawned); only the /system and /test trees hold programs, and
+        // /system/configuration holds none, so only the rest counts toward the
+        // spawn-everything sweep.
+        const is_program = (std.mem.startsWith(u8, item.name, "/system/") and
+            !std.mem.startsWith(u8, item.name, "/system/configuration/")) or
             std.mem.startsWith(u8, item.name, "/test/");
         if (!is_program) continue;
         programs += 1;
@@ -3267,21 +3269,23 @@ fn kernelVfsTest(boot_information: *const BootInformation) void {
         check("its first bytes are an ELF magic", n == 4 and header[0] == 0x7f and header[1] == 'E' and header[2] == 'L' and header[3] == 'F');
     }
 
-    // Directories resolve and enumerate: /system lists services/drivers.
+    // Directories resolve and enumerate: /system lists services/drivers/
+    // configuration (the CSV data files ride the same initrd tree).
     const root_directory = kernel_vfs.resolvePath("/system", false);
     check("/system resolves to a directory node", root_directory == .kernel_node);
     var saw_services = false;
     var saw_drivers = false;
+    var saw_configuration = false;
     var saw_stray_in_root = false;
     var saw_files_in_services = false;
     if (root_directory == .kernel_node) {
         var cursor: u64 = 0;
         var name: [64]u8 = undefined;
         while (kernel_vfs.nodeReaddir(root_directory.kernel_node, cursor, &name)) |entry| : (cursor += 1) {
-            if (eql(name[0..entry.name_len], "services")) saw_services = true else if (eql(name[0..entry.name_len], "drivers")) saw_drivers = true else saw_stray_in_root = true;
+            if (eql(name[0..entry.name_len], "services")) saw_services = true else if (eql(name[0..entry.name_len], "drivers")) saw_drivers = true else if (eql(name[0..entry.name_len], "configuration")) saw_configuration = true else saw_stray_in_root = true;
         }
     }
-    check("readdir /system yields services and drivers", saw_services and saw_drivers);
+    check("readdir /system yields services, drivers, configuration", saw_services and saw_drivers and saw_configuration);
     check("readdir /system yields nothing else (no /test leakage)", !saw_stray_in_root);
     const services = kernel_vfs.resolvePath("/system/services", false);
     if (services == .kernel_node) {

system/kernel/vfs.zig

@@ -7,7 +7,8 @@
 //!     mount (the initrd trees at /system and /test, the scratch ram nodes) resolves to a
 //!     stateless node TOKEN served directly by `fs_node` (read/status/readdir
 //!     with copy-out). A path under a USERSPACE mount (the fat server at
-//!     /mnt/usb and /var) resolves to the backend's ENDPOINT: the kernel
+//!     /volumes/usb, /system/configuration, and /system/logs) resolves to the
+//!     backend's ENDPOINT: the kernel
 //!     installs a (deduplicated) handle in the caller's table, rewrites the
 //!     path mount-relative, and the caller speaks the unchanged vfs-protocol
 //!     to the backend over the ordinary ipc_call rendezvous. The kernel never
@@ -21,9 +22,10 @@
 //! Mounting is `fs_mount(prefix, backend_handle, rewrite)`: possession of the
 //! backend endpoint handle is the capability, exactly the trust of the old
 //! userspace router's op-6 cap-pass. An optional REWRITE prefix maps the mount
-//! into the backend's namespace ("/var" -> fat's "/var" subtree while the same
-//! backend also serves "/mnt/usb" from its root), so FHS paths stay decoupled
-//! from which volume happens to carry them.
+//! into the backend's namespace ("/system/logs" -> the boot volume's
+//! identically-named subtree while the same backend also serves "/volumes/usb"
+//! from its root), so hierarchy paths stay decoupled from which volume happens
+//! to carry them.
 
 const std = @import("std");
 const abi = @import("abi");
@@ -99,7 +101,7 @@ var directory_count: usize = 0;
 /// If `path` lies under `mount_prefix` — equal to it, or the prefix followed by
 /// a path separator — return the path relative to the mount ("/" for an exact
 /// match, otherwise the tail beginning with '/'). Null when not under the
-/// mount, so "/mnt/usb" never captures "/mnt/usbextra".
+/// mount, so "/volumes/usb" never captures "/volumes/usbextra".
 pub fn underMount(path: []const u8, mount_prefix: []const u8) ?[]const u8 {
     if (path.len < mount_prefix.len) return null;
     if (!std.mem.eql(u8, path[0..mount_prefix.len], mount_prefix)) return null;
@@ -326,14 +328,30 @@ pub fn nodeReaddir(node_token: u64, cursor: u64, name_out: []u8) ?struct { heade
 
 // --- mount/unmount (syscall bodies; caller resolved the handle) --------------
 
+/// The writable subtrees a backend may mount beneath an initrd tree — exactly
+/// these two, nothing else. Longest-prefix resolution then routes them to the
+/// volume while every other /system and /test path stays initrd-served, so no
+/// bundled binary can ever be shadowed.
+const initrd_carve_outs = [_][]const u8{ "/system/configuration", "/system/logs" };
+
+fn isInitrdCarveOut(prefix: []const u8) bool {
+    for (initrd_carve_outs) |allowed| {
+        if (std.mem.eql(u8, prefix, allowed)) return true;
+    }
+    return false;
+}
+
 /// Mount `backend` at `prefix` with an optional backend-side `rewrite` prefix.
 /// The endpoint reference is taken by the caller (process.zig bumps it); refuses
-/// shadowing or replacing the initrd trees (/system, /test).
+/// shadowing or replacing the initrd trees (/system, /test) — except the two
+/// carve-outs in `initrd_carve_outs`, the writable configuration/log subtrees.
 pub fn mountBackend(prefix: []const u8, backend: *ipc.Endpoint, rewrite: []const u8) bool {
     if (!isAbsolute(prefix) or prefix.len < 2 or prefix.len > maximum_prefix) return false;
     if (rewrite.len > maximum_rewrite) return false;
-    for (&mounts) |*m| { // the initrd trees are not shadowable
-        if (m.used and m.kind == .kernel_initrd and underMount(prefix, m.prefixSlice()) != null) return false;
+    for (&mounts) |*m| { // the initrd trees are not shadowable (carve-outs aside)
+        if (m.used and m.kind == .kernel_initrd and underMount(prefix, m.prefixSlice()) != null) {
+            if (!isInitrdCarveOut(prefix)) return false;
+        }
     }
     installMount(prefix, .backend, backend, rewrite);
     return true;
@@ -353,12 +371,12 @@ pub fn unmount(prefix: []const u8) bool {
 // --- tests (host) ------------------------------------------------------------
 
 test "underMount matches only at path boundaries" {
-    try std.testing.expectEqualStrings("/", underMount("/mnt/usb", "/mnt/usb").?);
-    try std.testing.expectEqualStrings("/system/kernel", underMount("/mnt/usb/system/kernel", "/mnt/usb").?);
-    try std.testing.expect(underMount("/mnt/usbextra", "/mnt/usb") == null);
-    try std.testing.expect(underMount("/mnt", "/mnt/usb") == null);
-    try std.testing.expect(underMount("/other", "/mnt/usb") == null);
-    try std.testing.expect(underMount("greeting", "/mnt/usb") == null);
+    try std.testing.expectEqualStrings("/", underMount("/volumes/usb", "/volumes/usb").?);
+    try std.testing.expectEqualStrings("/system/kernel", underMount("/volumes/usb/system/kernel", "/volumes/usb").?);
+    try std.testing.expect(underMount("/volumes/usbextra", "/volumes/usb") == null);
+    try std.testing.expect(underMount("/volumes", "/volumes/usb") == null);
+    try std.testing.expect(underMount("/other", "/volumes/usb") == null);
+    try std.testing.expect(underMount("greeting", "/volumes/usb") == null);
 }
 
 test "parentOf walks toward the root" {

system/services/acpi/acpi.zig

@@ -215,7 +215,7 @@ fn onInit(endpoint: ipc.Handle) bool {
         const entry = registered[i];
         const hid = entry.hid[0..entry.hid_len];
         // The devices.csv columns (bus=acpi, hid) then the human-readable name — a
-        // would-be /etc/devices.csv row read straight off the boot log.
+        // would-be /system/configuration/devices.csv row read straight off the boot log.
         const desc = acpi_ids.description(hid);
         if (desc.len != 0)
             std.log.info("device {d}  bus=acpi hid={s}  —  {s}  ({d} resources)", .{ entry.device_id, hid, desc, entry.resource_count })

system/services/device-manager/device-manager.zig

@@ -28,7 +28,7 @@ const registry = @import("device-registry");
 const fs = @import("file-system");
 
 // --- the device registry ------------------------------------------------------
-// Driver matching is data-driven and authoritative: /etc/devices.csv (parsed by
+// Driver matching is data-driven and authoritative: /system/configuration/devices.csv (parsed by
 // the device-registry module) names, per bus, which driver binds a reported
 // device, the most-specific match winning. There is no compiled-in fallback — a
 // device no row matches goes unbound and is logged. This retired the hand-kept
@@ -41,12 +41,12 @@ var registry_source: [8192]u8 = undefined;
 var registry_rules: [64]registry.Rule = undefined;
 var registry_count: usize = 0;
 
-/// Read and parse /etc/devices.csv once at boot. The file lives in the initial
+/// Read and parse /system/configuration/devices.csv once at boot. The file lives in the initial
 /// ramdisk, which the kernel serves directly — no filesystem service need be up
 /// (fat is spawned after the manager), so this is a plain fs.open + read.
 fn loadRegistry() void {
-    var file = fs.open("/etc/devices.csv", .{}) orelse {
-        _ = logging.write("/system/services/device-manager: /etc/devices.csv missing — nothing will match\n");
+    var file = fs.open("/system/configuration/devices.csv", .{}) orelse {
+        _ = logging.write("/system/services/device-manager: /system/configuration/devices.csv missing — nothing will match\n");
         return;
     };
     defer file.close();
@@ -58,9 +58,9 @@ fn loadRegistry() void {
     }
     const result = registry.parse(registry_source[0..used], &registry_rules);
     registry_count = result.count;
-    if (result.malformed != 0) std.log.info("/etc/devices.csv: {d} malformed line(s) skipped", .{result.malformed});
-    if (result.truncated) _ = logging.write("/system/services/device-manager: /etc/devices.csv has more rules than the table holds\n");
-    std.log.info("/etc/devices.csv: {d} rule(s) loaded", .{registry_count});
+    if (result.malformed != 0) std.log.info("/system/configuration/devices.csv: {d} malformed line(s) skipped", .{result.malformed});
+    if (result.truncated) _ = logging.write("/system/services/device-manager: /system/configuration/devices.csv has more rules than the table holds\n");
+    std.log.info("/system/configuration/devices.csv: {d} rule(s) loaded", .{registry_count});
 }
 
 /// Build a registry Identity from a bus driver's report: the bus it named, the
@@ -443,7 +443,7 @@ fn onChildAdded(message: []const u8, reply: []u8, sender: u32) usize {
         if (!addChild(report.parent, report.bus_address, report.identity, report.device_id, sender)) status = -1;
         std.log.info("child added (device {d} port {d}, identity {d}) by {s}", .{ report.parent, report.bus_address, report.identity, driver.name() });
         if (status == 0) publishEvent(message[0..device_manager_protocol.child_added_size]);
-        // Matching from reports (M19.3), now data-driven via the /etc/devices.csv
+        // Matching from reports (M19.3), now data-driven via the /system/configuration/devices.csv
         // registry: a registered child gets the most-specific driver its identity
         // matches, once — re-reports after a bus restart dedupe on the registered
         // id, exactly like the registrations do.
@@ -451,7 +451,7 @@ fn onChildAdded(message: []const u8, reply: []u8, sender: u32) usize {
             const id = identityFromReport(report);
             if (registry.matchDriver(registry_rules[0..registry_count], id)) |match| {
                 if (match.ambiguous)
-                    std.log.info("/etc/devices.csv: multiple equally-specific rules match the device {s} reported; binding {s}", .{ driver.name(), match.driver });
+                    std.log.info("/system/configuration/devices.csv: multiple equally-specific rules match the device {s} reported; binding {s}", .{ driver.name(), match.driver });
                 if (id.bus == .acpi) {
                     // An hid-matched driver (ps2-bus) is a singleton that finds its
                     // own devices once spawned — spawn it once, no device assignment.

system/services/fat/engine.zig

@@ -73,7 +73,7 @@ const entries_per_sector = sector_size / @sizeOf(on_disk.DirectoryEntry); // 16
 // A small write-through cache of single-sector (metadata) accesses: FAT sectors,
 // directory sectors, and directory-entry writebacks. Its payoff is repeated scans
 // — resolving many paths under the same directory (a logging burst opening dozens
-// of files under /var/log/<stamp>/) re-reads the same directory and FAT sectors,
+// of files under /system/logs/<stamp>/) re-reads the same directory and FAT sectors,
 // which now come from RAM instead of a USB round trip each. Bulk file data (the
 // multi-sector run path) bypasses the cache — it is large and not re-read — and a
 // run write invalidates any overlapping cached sector to stay coherent.

system/services/fat/fat.zig

@@ -1,8 +1,8 @@
 //! system/services/fat — the FAT filesystem server. Spawned as a boot service, it
 //! opens the block device (a USB stick via usb-storage) under `.block`, mounts the
 //! FAT filesystem on it (the pure engine in engine.zig), and mounts itself into
-//! the VFS at /mnt/usb. From then on the VFS forwards every open/read/write/
-//! status/readdir/close under /mnt/usb to this server, which serves the same
+//! the VFS at /volumes/usb. From then on the VFS forwards every open/read/write/
+//! status/readdir/close under /volumes/usb to this server, which serves the same
 //! vfs-protocol as a backend — turning block reads into file reads.
 //!
 //! The block data path never crosses IPC: a DMA bounce buffer is handed to the
@@ -22,7 +22,7 @@ const engine = @import("engine.zig");
 const on_disk = @import("on-disk.zig");
 const vfs_protocol = @import("vfs-protocol");
 
-const mount_point = "/mnt/usb";
+const mount_point = "/volumes/usb";
 
 // The engine's BlockDevice, backed by the `.block` driver plus a DMA bounce
 // buffer the driver reads/writes by physical address.
@@ -144,18 +144,25 @@ fn tryBringUp() void {
     };
     std.log.info("mounted FAT ({s}, {d} clusters, partition lba {d})", .{ @tagName(filesystem.geometry.fat_type), filesystem.geometry.cluster_count, filesystem.base_lba });
 
-    // Mount ourselves into the kernel VFS at /mnt/usb — and serve /var from the
-    // volume's /var subtree, so FHS paths (the logger's /var/log) stay decoupled
-    // from which volume carries them.
+    // Mount ourselves into the kernel VFS at /volumes/usb — and serve
+    // /system/configuration and /system/logs from the volume's identically-named
+    // subtrees (the boot volume is hierarchy-shaped, so rewrite == prefix), so
+    // hierarchy paths (the logger's /system/logs) stay decoupled from which
+    // volume carries them.
     if (file_system.mount(mount_point, endpointForMount())) {
         std.log.info("mounted {s}", .{mount_point});
     } else {
-        _ = logging.write("/system/services/fat: could not mount /mnt/usb\n");
+        _ = logging.write("/system/services/fat: could not mount /volumes/usb\n");
     }
-    if (file_system.mountRewritten("/var", endpointForMount(), "/var")) {
-        std.log.info("mounted /var", .{});
+    if (file_system.mountRewritten("/system/configuration", endpointForMount(), "/system/configuration")) {
+        std.log.info("mounted /system/configuration", .{});
     } else {
-        _ = logging.write("/system/services/fat: could not mount /var\n");
+        _ = logging.write("/system/services/fat: could not mount /system/configuration\n");
+    }
+    if (file_system.mountRewritten("/system/logs", endpointForMount(), "/system/logs")) {
+        std.log.info("mounted /system/logs", .{});
+    } else {
+        _ = logging.write("/system/services/fat: could not mount /system/logs\n");
     }
     mounted = true;
 }

system/services/init/init.zig

@@ -29,17 +29,17 @@ const fs = @import("file-system");
 const csv = @import("csv");
 
 /// The system services init brings up at boot are init's policy, not the kernel's —
-/// and that policy is now data: `/etc/init.csv` (see `loadServices`), read at
+/// and that policy is now data: `/system/configuration/init.csv` (see `loadServices`), read at
 /// startup instead of a hardcoded list. Drivers are absent on purpose: the device
 /// manager owns those.
 ///
-/// The most services `/etc/init.csv` can list, and the most argv entries (beyond the
+/// The most services `/system/configuration/init.csv` can list, and the most argv entries (beyond the
 /// path) each may carry. Fixed caps because init parses the list into static storage —
 /// the freestanding, no-allocator counterpart to the device manager's registry table.
 const max_services = 16;
 const max_service_args = 4;
 
-/// One service init starts, parsed from a row of `/etc/init.csv`: its binary path
+/// One service init starts, parsed from a row of `/system/configuration/init.csv`: its binary path
 /// and argv, both slices into `init_csv` (held for the life of the process).
 const Service = struct {
     path: []const u8 = "",
@@ -50,7 +50,7 @@ const Service = struct {
     }
 };
 
-/// The `/etc/init.csv` bytes, held because the parsed services slice into them.
+/// The `/system/configuration/init.csv` bytes, held because the parsed services slice into them.
 var init_csv: [4096]u8 = undefined;
 var services: [max_services]Service = .{Service{}} ** max_services;
 var service_count: usize = 0;
@@ -65,16 +65,16 @@ var restart_counts: [max_services]u32 = .{0} ** max_services;
 var shutting_down = false;
 var supervision_endpoint: ipc.Handle = 0;
 
-/// Parse `/etc/init.csv` into `services`, in file order (startup order; shutdown is
+/// Parse `/system/configuration/init.csv` into `services`, in file order (startup order; shutdown is
 /// the reverse). Each row is a binary path followed by its argv, comma-separated;
 /// `#` comments and blank lines are ignored. The file lives in the initial ramdisk,
 /// which the kernel serves directly, so init — PID 1, running before any filesystem
 /// service — reads it with a plain fs.open, the same mechanism the device manager
-/// uses for /etc/devices.csv. A missing file means no services (the no-ramdisk
+/// uses for /system/configuration/devices.csv. A missing file means no services (the no-ramdisk
 /// isolation test): loud, but not fatal.
 fn loadServices() void {
-    var file = fs.open("/etc/init.csv", .{}) orelse {
-        _ = logging.write("/system/services/init: /etc/init.csv missing — no services started\n");
+    var file = fs.open("/system/configuration/init.csv", .{}) orelse {
+        _ = logging.write("/system/services/init: /system/configuration/init.csv missing — no services started\n");
         return;
     };
     defer file.close();
@@ -89,7 +89,7 @@ fn loadServices() void {
         const body = csv.stripComment(line);
         if (body.len == 0) continue;
         if (service_count >= services.len) {
-            _ = logging.write("/system/services/init: /etc/init.csv has more services than the table holds\n");
+            _ = logging.write("/system/services/init: /system/configuration/init.csv has more services than the table holds\n");
             break;
         }
         var it = csv.fields(body);
@@ -137,7 +137,7 @@ pub fn main() void {
 
     // Load the service list, then bring each up supervised so init can stop them
     // cleanly. Best-effort and silent: each service announces its own readiness,
-    // and with no /etc/init.csv (an isolation test) the loop starts nothing.
+    // and with no /system/configuration/init.csv (an isolation test) the loop starts nothing.
     loadServices();
     for (services[0..service_count], 0..) |*service, i| {
         if (process.spawnSupervised(service.path, service.arguments(), supervision_endpoint)) |id| child_ids[i] = id;

system/services/logger/logger.zig

@@ -4,7 +4,7 @@
 //! demultiplexes it into **one file per process** on the flash volume:
 //!
 //!     <base>/<boot-stamp>/<binary-path>.log
-//!     e.g. /mnt/usb/var/log/2026-07-21T101530Z/system/services/fat.log
+//!     e.g. /volumes/usb/system/logs/2026-07-21T101530Z/system/services/fat.log
 //!
 //! The boot stamp is the wall-clock time of boot (from klog_status), so one
 //! boot session is one self-contained directory; the kernel's own records go to
@@ -37,11 +37,11 @@ const time = @import("time");
 const logging = @import("logging");
 
 
-/// Where log trees live: the FHS path. The kernel VFS routes /var to whatever
-/// volume the fat server mounted there (today: the /var subtree of the USB
-/// flash volume) — swapping the persistent medium later touches fat's two
-/// mount calls, never this constant.
-const base = "/var/log";
+/// Where log trees live: the hierarchy path. The kernel VFS routes /system/logs
+/// to whatever volume the fat server mounted there (today: the /system/logs
+/// subtree of the USB flash volume) — swapping the persistent medium later
+/// touches fat's mount calls, never this constant.
+const base = "/system/logs";
 
 /// Drain cadence and the quiet period after which files are closed (flushed).
 const tick_ms = 250;
@@ -128,7 +128,7 @@ fn onTerminate() void {
 
 fn tick() void {
     if (!storage_ready) {
-        // makePath doubles as the readiness probe: while /var is unmounted the
+        // makePath doubles as the readiness probe: while /system/logs is unmounted the
         // resolve fails fast (no storage round trip) and the ring buffers; the
         // first success creates the whole per-boot tree.
         if (!fs.makePath(boot_directory[0..boot_directory_len])) return;