Stage B: logging policy documented, level-aware log-ring eviction built, LOG-FLUSH deferred again (FABRIC-3.md §XXXII.4)

Policy decided for the kernel-only audit scope: an interactive
command's direct response stays on console_println/console_puts;
everything else (state transitions, background diagnostics, audit
trails) routes through log_message() at the appropriate level,
matching capsule_mint.c's verify_mint() precedent. Documented, not
code-swept here -- reclassifying individual sites is Stage D's job.

LOG-FLUSH deferred again, explicitly: the per-VM log buffer its own
doc comment presumes (vm_log_buffer.h) doesn't exist anywhere in the
tree -- building it is real feature work needing its own scoped stage.

Level-aware eviction built: log_region_append() now reads the oldest
ring slot's own level before evicting it, protecting ERROR/WARN
records from being pushed out by INFO/DEBUG churn -- drops the
incoming low-priority record instead. Found and fixed an adjacent bug
while making this change: the prior two-valued return contract would
have made a benign "dropped by design" outcome indistinguishable from
a genuine write failure to its one caller, which unconditionally set
vm->error on any nonzero return. Changed to a three-valued contract (0
success, 1 dropped by design, -1 genuine failure).

Three-arch clean qemu acceptance passed. Eviction path itself not
live-exercised (needs 128+ LOG-APPEND calls to fill the ring) --
flagged, matching this project's own precedent for that kind of gap.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWpNjdwPtFLuVLaAq44L9K

include/starkernel/log_region.h

@@ -90,6 +90,15 @@ extern "C" {
 #define LOG_REGION_GROWTH_INCREMENT       4u
 #define LOG_REGION_MAX_DEVBLOCKS          32u  /* ceiling -- devblock_from_top stays within [66,96] */
 
+/* FABRIC-3.md §XXXII.4, 2026-09-15: level-aware eviction. Deliberately a
+ * raw numeric threshold, not log.h's LogLevel enum -- this file stays
+ * decoupled from log_message() entirely (see this header's own top-level
+ * doc comment on why). Matches LogLevel's own ordering (LOG_ERROR=0,
+ * LOG_WARN=1, LOG_INFO=2...): a slot at this level or lower is "protected"
+ * -- eviction refuses to discard it for an incoming record above this
+ * threshold, dropping the incoming record instead. */
+#define LOG_REGION_PROTECTED_MAX_LEVEL 1u /* LOG_WARN and below (ERROR, WARN) */
+
 #define LOG_SLOTS_PER_DEVBLOCK 4u   /* 4 x 1 KiB forth-blocks per 4 KiB devblock */
 #define LOG_SLOT_SIZE          1024u
 
@@ -162,9 +171,14 @@ typedef char log_slot_size_check[(sizeof(log_slot_t) == LOG_SLOT_SIZE) ? 1 : -1]
  * @param source_len Length of source (truncated to LOG_SLOT_SOURCE_MAX-1).
  * @param msg        Message text (not NUL-terminated required).
  * @param msg_len    Length of msg (truncated to LOG_SLOT_MSG_MAX).
- * @return 0 on success, -1 on any read/write failure (ring left however
- *         the failed operation left it -- blk_meta_zone_write() itself
- *         never partially writes a devblock).
+ * @return 0 on success. 1 if this record was dropped BY DESIGN, not a
+ *         failure -- writing it would have evicted a higher-priority
+ *         record still in the ring (LOG_REGION_PROTECTED_MAX_LEVEL,
+ *         §XXXII.4); the ring is left completely unchanged. -1 on any
+ *         genuine read/write failure (ring left however the failed
+ *         operation left it -- blk_meta_zone_write() itself never
+ *         partially writes a devblock). Callers that treat any nonzero
+ *         return as an error must not conflate these two cases.
  */
 int log_region_append(uint8_t level, uint64_t timestamp,
                        const char *source, uint32_t source_len,