diff --git a/docs/BRINGUP.md b/docs/BRINGUP.md
index e08ee26..05fda9b 100644
--- a/docs/BRINGUP.md
+++ b/docs/BRINGUP.md
@@ -1454,8 +1454,8 @@ accordingly ("Automatic — AP country, else World").
   Z jogs, ~70/75 samples). It gates nothing anywhere — it is telemetry (`/status`
   `switches.hv_enable`, control-panel "HV enable"). Naming note: the
   factory design labels this net **E-STOP**, and dated entries below
-  written before 2026-08-15 call it `estop`/`SW_ESTOP` with the
-  pre-rename polarity (the device tree then declared the pin active-high,
+  written before the rename (through the earlier 2026-08-15 records)
+  call it `estop`/`SW_ESTOP` with the pre-rename polarity (the device tree then declared the pin active-high,
   so the bit read HIGH at idle and LOW through a run — the same physical
   behavior, inverted); the DTS now declares it active-low so the bit
   reads as HV_ENABLE itself. The former `estop_halts_motion` /
@@ -2493,7 +2493,8 @@ accordingly ("Automatic — AP country, else World").
     module and DTB must ship together, the pin is required at probe; DTB
     compile-checked with cpp+dtc against the staged kernel) — **also
     bench-validated 2026-08-15:** two X jogs sampled at 50 Hz: `state`
-    running → `charge_pump_alive` 1 and `estop` 0 in the same 20 ms sample;
+    running → `charge_pump_alive` 1 and `estop` 0 (pre-rename name and
+    polarity of today's `hv_enable`) in the same 20 ms sample;
     after each run `charge_pump_alive` fell 0.325 s / 0.326 s after `idle`,
     which with the 200 ms feed phase (last pulse 0.136 s / 0.118 s before
     the run end) is a one-shot period of **0.46 s / 0.44 s** — matching
diff --git a/meta-forgefirm/recipes-extended/rsyslog/rsyslog/rsyslog.conf b/meta-forgefirm/recipes-extended/rsyslog/rsyslog/rsyslog.conf
new file mode 100644
index 0000000..2e2c8f7
--- /dev/null
+++ b/meta-forgefirm/recipes-extended/rsyslog/rsyslog/rsyslog.conf
@@ -0,0 +1,46 @@
+# /etc/rsyslog.conf - ForgeFIRM
+#
+# rsyslog is the only log writer on the machine. Every ForgeFIRM process
+# (forgectrl, grblHAL, gfcloud, gfhome), the kernel, and everything else
+# route to their own directory under /data/log/forgefirm. The per-logger
+# disk and remote levels come from /data/forgefirm.conf and are rendered
+# into the included rules file at every boot by `forgectrl
+# --render-syslog` (see the forgefirm-logging init script), so a change
+# made in the control panel applies at the next reboot.
+
+# Inputs: the local syslog socket and the kernel ring buffer. The
+# per-process rate limit bounds a runaway logger to a few hundred lines
+# per second so it cannot starve the machine; the emitters themselves
+# never block on this socket (they drop instead).
+module(load="imuxsock" SysSock.Use="on"
+       SysSock.RateLimit.Interval="10" SysSock.RateLimit.Burst="5000")
+module(load="imklog")
+
+global(workDirectory="/var/volatile/tmp"
+       maxMessageSize="16k")
+
+# One line format for every file: RFC 3339 timestamp with sub-second
+# precision, program[pid], SEVERITY, message.
+template(name="ff_line" type="list") {
+    property(name="timegenerated" dateFormat="rfc3339")
+    constant(value=" ")
+    property(name="programname")
+    constant(value="[")
+    property(name="procid")
+    constant(value="] ")
+    property(name="syslogseverity-text" caseConversion="upper")
+    property(name="msg" spifno1stsp="on")
+    property(name="msg" droplastlf="on")
+    constant(value="\n")
+}
+
+# The rendered per-logger rules (levels, remote target). Every message
+# is consumed there (each block ends in stop).
+include(file="/data/forgefirm/rsyslog-forgefirm.conf" mode="optional")
+
+# Reached only if the rules file is missing (a boot where the render
+# failed): keep everything, on disk, at info and above.
+if $syslogseverity <= 6 then action(type="omfile"
+    file="/data/log/forgefirm/system/system.log" template="ff_line"
+    asyncWriting="on" flushOnTXEnd="off" flushInterval="1"
+    fileCreateMode="0640" dirCreateMode="0755" createDirs="on")