feat(userspace): log server sole console holder; init boots from manifest; adapter loads only init+storage

docs/ipc.md

@@ -67,17 +67,24 @@ No process is privileged by its id. At boot the kernel gives init:
 - one `Console` capability (`Write`, `Delegate`).
 
 `DebugPutchar(console, byte)` needs a `Console` capability with `Write`;
-there is no other way to reach the UART. Init lends its console to the
-servers it starts (snake gets none). Until the log server owns the console,
-boot code also grants one to the servers it loads itself.
+there is no other way to reach the UART. Init prints with it only until it
+has started the log server, then hands it over and drops its own; from then
+on the log server is the only holder, and every other process prints by
+calling it (`types::log`) if init gave it a log endpoint.
 
 A thread made by `SpawnThread`/`SpawnThreadIn` starts with the caller's
 `arg` in `a0`. A process's first thread reads it as `types::start_arg`:
 the slots of the console and log capabilities it was handed.
 
-The board capabilities come after the capabilities boot code hands out
-for the built-in servers, so those slots are unchanged. Device regions
-never overlap each other or the frame pool, and each device has exactly
+Boot loads only init and storage (init needs it to read anything else):
+init gets storage's process and endpoint in slots 1 and 2, before the
+board capabilities. Everything else init starts from its manifest
+(`init/src/manifest.rs`), handing each program only the endpoints, device
+and budget listed there. Storage, started before the log server, receives
+its log endpoint from init later (`SET_LOG`, accepted only from the
+unbadged holder of its endpoint).
+
+Device regions never overlap each other or the frame pool, and each device has exactly
 one region, so delegating or revoking it means the same thing everywhere.
 
 `RegionAddress(cap)` returns a region's physical base so a driver can