reorg: move system/devices into system/kernel/devices

With the shared device data (device-abi, pci-class, usb-abi, usb-ids, acpi-ids,
aml) now in library/device/, what remained in system/devices/ was purely
kernel-internal: the firmware-discovery machinery and the rich pointer-based
device model (platform, device-model, acpi, device-tree, power), reached only
through the "platform" module by three kernel files. It belongs with the kernel.

Move it to system/kernel/devices/. A pure relocation: the "platform" module
name is unchanged and every cross-dir dependency is a module import, so only the
one b.path and some comments move. The top-level split is now clean —
system/kernel/ is the kernel, library/device/ the shared device libraries,
system/{drivers,services} the userspace. The runtime /system/devices concept
(the virtual device tree) is unaffected; system/kernel/devices/ is its
implementation.

Also fixes two comment refs that still pointed device-abi at its pre-Wave-1a
home (system/devices/) — it lives at library/device/model/ now.

zig build + test green; smoke, discovery, acpi-parse, acpi-ps2, acpi-report pass.

build.zig

@@ -278,7 +278,7 @@ pub fn build(b: *std.Build) void {
     });
     // The devices sub-project's public interface (the flat wire types), exposed as
     // its own module like vfs-protocol — importable by user space, unlike the
-    // kernel-internal device model it also feeds (system/devices/device-model.zig).
+    // kernel-internal device model it also feeds (system/kernel/devices/device-model.zig).
     const device_abi_module = b.addModule("device-abi", .{
         .root_source_file = b.path("library/device/model/device-abi.zig"),
     });
@@ -351,9 +351,9 @@ pub fn build(b: *std.Build) void {
     // "platform" and asks it to enumerate hardware into a backend-neutral device
     // tree, never naming ACPI (or, later, device-tree) — the same discipline the
     // architecture module applies to CPU code. The backend is selected at runtime from
-    // the boot handoff (see system/devices/platform.zig).
+    // the boot handoff (see system/kernel/devices/platform.zig).
     const platform_module = b.addModule("platform", .{
-        .root_source_file = b.path("system/devices/platform.zig"),
+        .root_source_file = b.path("system/kernel/devices/platform.zig"),
         .imports = &.{
             .{ .name = "boot-handoff", .module = boot_handoff_module }, // BootInformation (carries the ACPI RSDP), physicalToVirtual
             .{ .name = "abi", .module = abi_module }, // acpi.zig works in page_size units

docs/README.md

@@ -238,8 +238,9 @@ system/          → /system   danos's own internals (the self-representation)
   parameters.zig  initial-ramdisk.zig   shared contracts
   kernel/                     IPC, memory, scheduling, the VFS root, the private syscall dispatch
     architecture/x86_64/      the `architecture` module (never named by generic code)
-  devices/                    the kernel-internal device model (device-model, platform,
+    devices/                  the kernel-internal device model + firmware discovery
-                              acpi, device-tree, power) that /system/devices reflects
+                              (device-model, platform, acpi, device-tree, power) — the
+                              implementation of the device tree /system/devices reflects
   drivers/     pci-bus/ ps2-bus/ usb-xhci-bus/   one sub-project per driver → /system/drivers
   services/    init/ fat/ device-manager/   system servers → /system/services (fat/ holds
                               fat.zig, engine.zig, on-disk.zig)
@@ -299,7 +300,7 @@ exception in [coding-standards.md](coding-standards.md) applies to that seam.
 | VFS root: mount table + kernel-served nodes (`fs_resolve`/`fs_node`); wire protocol in `library/protocol/vfs/vfs-protocol.zig` | `system/kernel/vfs.zig` |
 | Device tree + claim capability + `device_register` containment | `system/kernel/devices-broker.zig` |
 | IRQ-as-IPC: routing a device interrupt to a driver's endpoint | `system/kernel/irq.zig` |
-| Hardware discovery (ACPI/device tree) behind one neutral device model | `system/devices/` |
+| Hardware discovery (ACPI/device tree) behind one neutral device model | `system/kernel/devices/` |
 | Framebuffer text console (mirrors to serial) | `system/kernel/console.zig` |
 | In-kernel test cases | `system/kernel/tests.zig` |
 | Arch-specific kernel code (`halt`, GDT/IDT/TSS, exception + interrupt stubs, page tables, APIC/IO-APIC/timer, serial, linker script) | `system/kernel/architecture/x86_64/` |

docs/acpi.md

@@ -19,10 +19,10 @@ UEFI configuration table
 BootInformation.acpi_rsdp   (u64, in the loader↔kernel handoff)   system/boot-handoff.zig
    │  the kernel forwards the whole BootInformation
    ▼
-platform.discover(boot_information, …)                                  system/devices/platform.zig
+platform.discover(boot_information, …)                                  system/kernel/devices/platform.zig
    │  reads boot_information.acpi_rsdp, hands it to the ACPI backend
    ▼
-acpi.discover(rsdp_phys, …)                                      system/devices/acpi.zig
+acpi.discover(rsdp_phys, …)                                      system/kernel/devices/acpi.zig
    │  dereferences the RSDP, reads the pointer it contains
    ▼
 RSDP ──(a field in the struct)──► RSDT / XSDT ──► SDTs (MADT, MCFG, FADT, HPET, DSDT…)

docs/power.md

@@ -92,7 +92,7 @@ fails rather than hangs.
 `acpi-tables` node ([discovery.md](discovery.md)) already put the PM1 control
 ports in the acpi service's hands, so writing S5 from ring 3 is something it
 could physically already do; formalizing it as a protocol operation added a
-contract, not authority. The kernel's `system/devices/power.zig` keeps only
+contract, not authority. The kernel's `system/kernel/devices/power.zig` keeps only
 **reboot** (the FADT reset register plus the legacy fallbacks, which need no AML);
 it has no poweroff path at all — S5 is not a kernel operation.
 

docs/system-requirements.md

@@ -115,7 +115,7 @@ hypervisor configured for UEFI firmware and an xHCI USB controller.
   (`efi.zig:790`, `boot-handoff.zig:149`)
 - **Required ACPI tables:** MADT (interrupt topology), MCFG (PCIe ECAM base),
   FADT (power / PM timer). Optionally consumed: HPET, DMAR, SPCR.
-  (`system/devices/acpi.zig:3`)
+  (`system/kernel/devices/acpi.zig:3`)
 - The loader reads `/system/kernel` off the FAT boot volume, then loads user
   space: a prebuilt `boot\system.img` capsule
   ([system-image.md](system-image.md)) when present, otherwise it walks
@@ -221,7 +221,7 @@ named for reporting only; internal SATA / NVMe / IDE disks have no driver.
 first VT-d DRHD unit and its capabilities are exposed via `PlatformInformation`
 (`iommu_present`, `iommu_base`, `iommu_version`). No DMA-remapping tables are
 programmed and no translation is enforced. An IOMMU is therefore **not required**
-and does not currently constrain devices. (`system/devices/acpi.zig:96`)
+and does not currently constrain devices. (`system/kernel/devices/acpi.zig:96`)
 
 ## What is explicitly NOT supported
 

library/device/model/device-abi.zig

@@ -6,7 +6,7 @@
 //! by name, and neither reaches into the other's files.
 //!
 //! It is also the **single source of truth** for `DeviceClass` and `ResourceKind`:
-//! the kernel's rich, pointer-based device tree (system/devices/device-model.zig,
+//! the kernel's rich, pointer-based device tree (system/kernel/devices/device-model.zig,
 //! which user space must never import) re-exports these, so the enum that a driver
 //! matches on and the enum the kernel classifies with are the *same* type — no
 //! hand-kept "mirror in order" to drift. The core kernel↔user ABI is [[abi]]; the

system/abi.zig

@@ -13,7 +13,7 @@
 //!
 //! This is the *core* contract; the device half — `DeviceDescriptor` and friends, which
 //! also cross this boundary — lives with the device sub-project as [[device-abi]]
-//! (system/devices/device-abi.zig). The loader↔kernel handoff is [[boot-handoff]].
+//! (library/device/model/device-abi.zig). The loader↔kernel handoff is [[boot-handoff]].
 
 /// Page size every `mmap`/`munmap` grant and the boot memory map are measured in.
 /// 4 KiB on every architecture danos targets so far. Part of the ABI because the

system/boot-handoff.zig

@@ -5,7 +5,7 @@
 //!
 //! Both binaries import this as the `boot-handoff` module, so the layout is defined
 //! in exactly one place. **User space never sees this** — the kernel↔user contract is
-//! [[abi]] (system/abi.zig); device types are [[device-abi]] (system/devices/device-abi.zig).
+//! [[abi]] (system/abi.zig); device types are [[device-abi]] (library/device/model/device-abi.zig).
 
 const std = @import("std");