9proc core becomes a backend of cloud9.fs; engine gains optional features

9proc's own fid table, walk loop and dir-read engine are replaced by
cloud9.fs.Server; the tree (static, vars, providers) is served through the
engine's Req/Reply contract with node ids that keep the old qid scheme.
Providers may answer later by returning error.Again (parked in the engine,
retried each step, Tflush -> EINTR); no new files are exposed.
Engine (backward compatible, all opt-in via Backend.features / Options):
create, remove, wstat, reference accounting for backends that count
handles, a salted fid index, name_capacity 0 (names from getattr),
Reply.ename for backend-chosen error text, Attr.path/version/atime.
Engine-level error strings and the 217-byte msize floor now apply to 9proc;
tests updated accordingly.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

1 files changed, 24 insertions, 6 deletions

diff --git a/docs/design.md b/docs/design.md
index dda10a6..8387a4d 100644
--- a/docs/design.md
+++ b/docs/design.md
@@ -104,13 +104,31 @@ negotiating.
 
 Every table is sized at comptime by `fs.Options`: `fid_capacity` (256),
 `slot_capacity` (32), `park_data_max` (128), `name_capacity` (28, at most
-255) and `username_capacity` (28); the defaults are the editor's, except the
-name capacity, which is the board's. `msize_min` (217) is the smallest
-negotiable msize, one full Rwalk. Create, remove, auth, attaching a named
-tree and any wstat other than a zero-length truncation are refused. Rerror
-strings are the ones Linux v9fs maps back to errnos (`fs.errString`). The
+255; zero keeps no names, a stat's name is then the one its getattr
+answers and the backend judges name lengths), `username_capacity` (28) and
+`fid_index` (off: an open-addressing index from fid number to slot, two
+bytes per bucket, for tables of thousands of fids; `InitOptions.seed`
+salts it); the defaults are the editor's, except the name capacity, which
+is the board's. `msize_min` (217) is the smallest negotiable msize, one
+full Rwalk. Auth and attaching a named tree are refused, and so are
+create, remove and any wstat other than a zero-length truncation unless
+the backend declares the feature: a backend may carry `pub const features:
+fs.Features` naming `create` (Tcreate becomes an `open` with `create`,
+`data` the name, `perm` and `omode`, answered with the new node's `attr`
+and handle), `remove` (Tremove, and ORCLOSE on clunk or hangup, become a
+`release` with `remove`; its error is the Rremove's), `wstat` (a Twstat
+becomes a `setattr` whose `set` names the changed fields: `data` the new
+name, `perm`, `mtime`, `length`; the fields the engine owns must be "don't
+care") and `references` (every lookup result, "." and a fid clone
+included, is a reference the backend gets exactly one `release` for, with
+`opened` telling whether an open handle goes with it). An `Attr` may add
+a qid `version`, `atime`, a qid `path` distinct from the node, and the
+append-only and exclusive-use bits; a reply's `ename` replaces
+`errString(errno)` as the Rerror text. Rerror strings the engine emits on
+its own are the ones Linux v9fs maps back to errnos (`fs.errString`). The
 engine allocates nothing and makes no OS calls; a session is `push()`,
-`retry()`, `next()`, `reply()`, `output()`, `wrote()`.
+`retry()`, `next()`, `reply()`, `output()`, `wrote()`; `fidCount()` counts
+the fids held.
 
 # Related programs