docs: audit all 'what's next' sections against the code; fix stale comments

Verified every deferred item in the nine docs with a what's-next section and
marked what has since landed (reaper, per-process CR3, higher-half kernel,
kernel heap, contiguous frame alloc, RSDP capture, cap-passing, driver restart
with backoff, PS/2 keyboard) while keeping the genuinely open items. Also
corrects interrupts.md's claim that the keyboard skipped the IO-APIC, and
updates scheduler.zig/heap.zig comments that predated the reaper and the big
kernel lock.

docs/ipc.md

@@ -87,13 +87,15 @@ elsewhere is not lost.
 This is what makes a user-space driver possible at all, and it's the subject of
 [drivers.md](drivers.md).
 
-## What's next (not done here)
+## What's next (partly done since)
 
-- **Priority inheritance** through IPC, so a high-priority client blocked on a
-  low-priority server doesn't suffer unbounded priority inversion.
-- **Handle transfer.** A server can't hand a client a handle to a third endpoint, so
-  every capability is either well-known (the registry) or inherited — there's no way
-  to delegate one.
+- **Priority inheritance** through IPC — still open: a high-priority client
+  blocked on a low-priority server suffers unbounded priority inversion.
+- **Handle transfer.** *Landed as cap-passing (M13)*: `ipc_call` and
+  `ipc_reply_wait` carry an optional capability alongside the bytes (`send_cap`),
+  copying an endpoint or shared-memory handle into the peer's table. First user:
+  [input](input.md) subscribers register by handing over their own endpoint, and
+  class drivers get a private channel to one device.
 - **Asynchronous / buffered send** for the cases where a rendezvous is the wrong
   shape (logging, notifications between servers). *Landed as `ipc_send`* — a
   non-blocking post to an endpoint's bounded payload queue, delivered through
@@ -101,8 +103,11 @@ This is what makes a user-space driver possible at all, and it's the subject of
   first used by, the [input service](input.md)'s keyboard-event broadcast, where a
   synchronous push would let one dead subscriber hang the fan-out. A full queue drops
   the oldest (discrete messages, not a coalescing level like the notification ring).
-- **A bounded reply.** `MSG_MAX` is 256 bytes and the copy runs under the big kernel
-  lock; a bulk transfer wants shared pages, not a copy.
+- **A bounded reply** — half landed. The copy is still 256 bytes
+  (`MESSAGE_MAXIMUM`) under the big kernel lock, but bulk transfer got its shared
+  pages: `shared_memory_create`/`map`/`physical`, the region handle delegated as
+  a capability (above). virtio-gpu's scanout surface is the first user
+  ([display-v2.md](display-v2.md)).
 
 ## Lifecycle conventions over IPC (M17)