fs: mount the builtins at /bin

The commands only existed in the kernel's program table, so the only way to
find out what the machine could do was to already know (or read the source).
They are now a directory in the tree:

    /# ls /                      /# xxd -l 16 /bin/uname
    bin                          0000: cd 6b 43 06 00 0e 00 f7 .kC.....
    readme                       0008: 18 fe 47 0e 03 f7 c9 21 ..G....!
    /# ls -l /bin | head -2
    -  1 16384 worker

/bin is synthetic, not disk: dir_find resolves "bin" in the root to BIN_INO
and names inside it through the NameTable, so `ls /bin` lists exactly what the
shell can run - one table, one truth, no second list to keep in sync. The root
listing carries "bin" as a synthetic first entry so it is discoverable by
walking the tree.

A program image is inode BIN_FILE|progid: it stats as a 16 KiB file (a program
IS its ROM bank) and reads through rom_getb, which maps that bank, takes the
byte, and maps the CALLER'S text bank back before returning - the caller is
itself executing from $4000, so leaving the wrong bank mapped would return
into another program's code. Verified byte-for-byte against the host's view of
the blob. The tree is read-only: create/remove/write inside /bin all fail.

xxd grows -l (stop after N bytes), because a program image is 2048 dump lines
- more than a pipe's temp file can hold, let alone the screen.

Two traps worth remembering, both found the hard way here: `and BIN_FILE`
destroys A, so the inode must be reloaded before inode_ptr (missing it once
made ls -l stat inode 0 and call every file an empty non-directory); and ls
now copies its directory argument to the stack first, because stat()'s request
block is a static living at $A000 - on top of the command line it was reading.

1 files changed, 11 insertions, 0 deletions

diff --git a/docs/internals.md b/docs/internals.md
index f9c5899..f630025 100644
--- a/docs/internals.md
+++ b/docs/internals.md
@@ -241,6 +241,17 @@ blocks 4..  data blocks
 - **`sys_stat` / `sys_fsstat`** back `ls -l` and `df`. The syscall trap needs
   HL for its dispatch table, so a call taking both a path and an output
   buffer passes a request block, the shape SYS_NET already uses.
+- **`/bin` is synthetic.** It is not on the disk: `dir_find` resolves "bin" in
+  the root to `BIN_INO`, and names inside it through the kernel's own
+  NameTable, so `ls /bin` shows exactly what the shell can run - one table,
+  one truth. A program image is inode `BIN_FILE|progid`, `stat`s as a 16 KiB
+  file (a program IS its ROM bank) and reads through `rom_getb`, which maps
+  that bank, takes the byte, and maps the CALLER'S text bank back before
+  returning - the caller is itself running from `$4000`. The whole tree is
+  read-only: creating, removing or writing inside `/bin` fails.
+  NB every `and BIN_FILE` test destroys A, so the inode has to be reloaded
+  before `inode_ptr`; forgetting that once made `ls -l` stat inode 0 and
+  report every file as an empty non-directory.
 - **Paths + per-process cwd.** `open`/`mkdir`/`chdir`/`remove`/`ls` take paths
   (absolute `/a/b` or relative `a/b`); each process has a cwd inode (`PROC_CWD`,
   inherited on fork). Shell builtins: `cd`, and a cwd-aware prompt.