M11–M12: IRQ-as-IPC and bus drivers; expand names tree-wide

Two driver-model milestones plus a tree-wide naming pass. Suite 35/35
(QEMU) + host tests green.

M11 — IRQ-as-IPC. A ring-3 driver now sleeps until its device interrupts
it. New src/kernel/irq.zig: per-GSI endpoint bindings, comptime per-vector
trampolines, dispatch = mask GSI -> LAPIC EOI -> notifyLocked, all under one
lock region. irq_bind/irq_ack syscalls, gated by the device claim like
mmio_map. interruptDispatch no longer EOIs — each handler owns its EOI,
because a level line must be masked before it is acknowledged (irq_ack is
the unmask). Bindings are keyed on the owning task and released on exit
(a shared endpoint's siblings survive). hpetd rewritten interrupt-driven.
Tests: hpet (rewritten, reads back the I/O APIC routing) and irqfree.

M12 — bus drivers. DeviceDesc gains a parent, making the device table a
tree. dev_register (device_register) lets a process publish children below
a device it claimed; the kernel enforces resource containment (a child's
resources must nest in its parent's), so a descriptor can't fabricate a
window over kernel RAM. Descriptor copied in via copyFromUser (physmap
walk — an unmapped user pointer fails the call instead of faulting the
kernel). Per-parent child cap bounds table exhaustion. sbin/busd.zig is a
worked bus driver. Test: bus.

Naming — per docs/coding-standards.md: non-acronym abbreviations spelled
out (message, descriptor, device_service, scheduler, runtime, physical,
interpreter, ...); acronyms kept (IPC, MMIO, DMA, HCD, ...); files are
kebab-case (ipc-synchronous.zig, device-service.zig, vfs-protocol.zig, ...).
Exceptions: POSIX/C ABI names and Zig idioms (init/len/ptr) kept. Module
collisions resolved by specific naming (config -> parameters, device.zig
alias -> device_model). AML op/Op disambiguated: op = opcode, Op =
operation; per-opcode parse handlers renamed opX -> parseX.

New driver docs: drivers.md, driver-model.md (bus/class/HCD shapes + the
proposed M13–M16 ABI), coding-standards.md.

docs/ipc.md

@@ -6,12 +6,20 @@ just call each other — a request becomes a **message**. In a microkernel, what
 was a function call across a monolithic kernel is IPC, so it's a first-class
 concern, not an afterthought.
 
-This first form is a **bounded blocking channel** (`src/kernel/ipc.zig`): a fixed-size
-ring buffer of messages with a producer/consumer rendezvous, built on the
-scheduler's [wait queues](scheduling.md).
+There are two layers, built a milestone apart:
+
+- **`src/kernel/ipc.zig`** — a bounded blocking channel between *kernel threads*,
+  described below. The primitive, and where the blocking discipline was worked out.
+- **`src/kernel/ipc-synchronous.zig`** — synchronous call/reply between *processes*, across
+  address spaces. What user-space servers and drivers actually talk over. It's the
+  second half of this document.
 
 ## The channel
 
+The first form is a **bounded blocking channel** (`src/kernel/ipc.zig`): a fixed-size
+ring buffer of messages with a producer/consumer rendezvous, built on the
+scheduler's [wait queues](scheduling.md).
+
 `Channel(T, capacity)` is generic over the message type and buffer size. It holds a
 ring buffer, a count, and two wait queues:
 
@@ -42,16 +50,51 @@ full and empty over and over, so both the blocking-send and blocking-recv paths
 exercised heavily. The messages arrive intact and in order (their sum is the
 expected `5050`), and neither task busy-waits — they block and wake each other.
 
+## Endpoints: call/reply across address spaces
+
+A channel connects two kernel threads sharing one address space. Real servers are
+*processes*, so the payload has to cross an address-space boundary. That's
+`src/kernel/ipc-synchronous.zig`, and its shape is L4's: a synchronous **rendezvous** at an
+`Endpoint`, with the message copied directly from the sender's pages to the receiver's
+(`copyAcross` walks both sets of page tables through the physmap — no CR3 switch, no
+bounce buffer).
+
+Two syscalls carry it:
+
+- **`ipc_call(h, msg, reply)`** — copy `msg` to the server, block until it replies.
+- **`ipc_reply_wait(h, reply, recv)`** — reply to the client you're still holding (if
+  any), then block for the next request. One syscall, because a server's steady state
+  is *always* "finish the last one, wait for the next".
+
+An endpoint is reached by **handle** — a small integer index into the process's handle
+table (`Task.handles`), exactly like a file descriptor, and just as unforgeable. The
+bootstrap problem (how do you get the first handle?) is solved by a tiny name registry:
+a server calls `ipc_register(service_id, h)` under a well-known small integer, and a
+client calls `ipc_lookup(service_id)`.
+
+The server never learns the client's identity beyond a **badge**, delivered alongside
+the message: the caller's task id.
+
+### Interrupts are messages too
+
+`notifyFromIsr` posts an *asynchronous* notification to an endpoint — no payload, no
+reply owed — and wakes whoever is blocked in `reply_wait`. Its badge has the top bit
+set (`notify_badge_bit`), which is how a driver's single event loop distinguishes "a
+client wants something" from "the hardware wants something". Notifications sit in a
+small coalescing ring on the endpoint, so an interrupt taken while the driver was busy
+elsewhere is not lost.
+
+This is what makes a user-space driver possible at all, and it's the subject of
+[drivers.md](drivers.md).
+
 ## What's next (not done here)
 
-- **Across address spaces.** Today both endpoints are kernel threads sharing the
-  kernel's memory, so the message is copied within one address space. When user
-  mode arrives, the same channel carries messages between *isolated* processes,
-  copying the payload across the boundary — which is where IPC earns its place as
-  the microkernel's backbone.
-- **Synchronous call/reply.** A request/response pattern (send-and-wait-for-reply)
-  on top of channels, the shape most driver/service calls take.
-- **Interrupts as messages.** A hardware interrupt delivered to the driver task
-  that owns the device, as an IPC message.
 - **Priority inheritance** through IPC, so a high-priority client blocked on a
   low-priority server doesn't suffer unbounded priority inversion.
+- **Handle transfer.** A server can't hand a client a handle to a third endpoint, so
+  every capability is either well-known (the registry) or inherited — there's no way
+  to delegate one.
+- **Asynchronous / buffered send** for the cases where a rendezvous is the wrong
+  shape (logging, notifications between servers).
+- **A bounded reply.** `MSG_MAX` is 256 bytes and the copy runs under the big kernel
+  lock; a bulk transfer wants shared pages, not a copy.