feat(init): supervise servers+session progs: restart on death, same endpoint, backoff 0/1/5/30s then give up, restarts_clients cascade; release grants/spawn at stop (stale-slot safe); storage death fatal; init output via printer thread (never blocks on log); terminal Ctrl+C via CONTROL-badged copy, latest wins; flaky test server + spawntest restart/backoff check

docs/ipc.md

@@ -118,11 +118,24 @@ stops there.
 
 Signing out (`types::spawn::SIGN_OUT`, sent one way through the copy of
 init's endpoint the shell holds) stops everything the session ran (the
-shell, the permission manager, every app), tells the terminal
-(`SIGNED_OUT`, init only), locks storage (`LOCK`, init only: every grant
+shell, the permission manager, every app), locks storage (`LOCK`, init only: every grant
 taken back, every file closed, the key forgotten), removes a guest's
 files, and runs the gatekeeper again.
 
+Init restarts what dies (`init/src/supervise.rs`): every server, and the
+session's programs, except the gatekeeper and storage. A restarted server
+gets the same endpoint, so its clients' capabilities reach the new one;
+what it held in memory is gone. One whose clients keep state in it
+(`restarts_clients`: input, display, terminal, the permission manager) has
+them restarted after it, in turn. Crashes in a row wait longer each time
+(at once, 1 s, 5 s, 30 s), then init gives up on it; a minute's run
+forgives earlier crashes. What init gave a program through itself (its
+storage grants, its spawn allowance and the children spawned from it) is
+taken back as soon as it stops or dies. Storage's death stops the system:
+it holds the key and every grant. Init's main thread never waits on a
+server it restarts: its own output goes through a thread of its own
+(`init/src/output.rs`), which waits on the log server instead.
+
 A program's `uses` endpoints arrive as badged copies with `Execute` and
 `Delegate`: the badge (unique per copy) tells the server which client is
 calling, and `Delegate` lets the client send capabilities with its calls
@@ -151,7 +164,9 @@ is whatever text endpoint a program was given. `READ` (`types::terminal`)
 blocks until a line is typed and returns it in chunks, the last ending in
 `\n`. Ctrl+C there drops the line. Keys typed while no line is read are
 kept for the next one, except Ctrl+C, which signals the notification the
-session's first `ON_INTERRUPT` caller (its shell) gave. `REDRAW` repaints the screen and takes
+latest `ON_INTERRUPT` caller gave. Only a terminal copy whose badge has
+`CONTROL` may register: init mints one for the shell alone, and the copy
+the shell passes on to apps is its plain one. `REDRAW` repaints the screen and takes
 input focus back.
 
 The desktop is the shell, given the terminal, the permission manager,