docs: full docs-vs-code audit — fix every stale claim across 40 docs

Every doc verified claim-by-claim against the code by parallel audit agents,
then fixed and adversarially re-verified. Two waves of staleness corrected:
the originally audited findings (higher-half boot handoff, kernel VFS
takeover, fault isolation + claim release + driver restart, AML/S5 moving to
ring 3, threading's shipped design, USB+FAT landing) and a second pass of
adjacent claims the verifiers caught (smp.md 'not built yet' intro,
system-requirements' PS/2-only and no-storage claims, halting.md's red-panic
and no-IDT text, testing.md's serial mirroring, router-era vfs-protocol
wording, capsule-first boot loading).

threading.md now documents the shared-fate gap explicitly: the design says a
process dies whole, the kernel today kills only the offending thread.

Also fixes three stale code comments (isr.s exceptionHandler, acpi.zig
sleepValue, build.zig boot-volume) — comments only, no behavior change.

docs/driver-model.md

@@ -33,7 +33,7 @@ plain bus driver with no controller — a USB hub — is also a real thing.
 ## The device table is the spine
 
 danos already has the right central structure. `system/kernel/devices-broker.zig` holds a table of
-`DeviceDesc`, each with a parent, a class, and a set of resources. Firmware discovery
+`DeviceDescriptor`, each with a parent, a class, and a set of resources. Firmware discovery
 seeds it ([discovery.md](discovery.md)); `device_register` grows it.
 
 Three invariants make it a capability system rather than a directory:
@@ -67,7 +67,7 @@ const base = dev.mmioMap(bus.id, 0).?;       // 2. enumerate it — from the har
 const n = ((cap.* >> 8) & 0x1F) + 1;         //    GENERAL_CAP says how many children
 
 for (0..n) |i| {                             // 3. publish each child
-    var child = std.mem.zeroes(dev.DeviceDesc);
+    var child = std.mem.zeroes(dev.DeviceDescriptor);
     child.class = @intFromEnum(dev.DeviceClass.timer);
     child.resource_count = 1;
     child.resources[0] = .{ .kind = memory,
@@ -96,8 +96,11 @@ A "family" is two modules, not one:
   *whatever* published its device. This is the part that makes class drivers portable.
 
 danos already has one of each: `library/runtime/device.zig` is a logic module,
-[`system/services/vfs/protocol.zig`](system/services/vfs/protocol.zig) is a protocol module shared by `system/services/vfs/vfs.zig`
-and its clients. The pattern generalises directly:
+[`system/vfs-protocol.zig`](system/vfs-protocol.zig) is a protocol module shared by the
+mount backends (today the fat server) and their clients. (The user-space VFS server it
+was originally written against has since retired — path routing moved into the kernel,
+`system/kernel/vfs.zig`'s `fs_resolve` — but the protocol module outlived it, which is
+rather the point.) The pattern generalises directly:
 
 ```
 library/
@@ -107,7 +110,7 @@ library/
     pci/            module "pci"     — ECAM, BAR decode, capability walk
     usb/            module "usb"     — descriptors, control transfers, hubs
   proto/
-    vfs/            module "vfs-protocol"  (today: system/services/vfs/protocol.zig)
+    vfs/            module "vfs-protocol"  (today: system/vfs-protocol.zig)
     block/          module "block-protocol"
     hid/            module "hid-protocol"
 
@@ -117,10 +120,11 @@ system/drivers/     one sub-project each → /system/drivers (no `d` suffix)
   block/      class driver        imports runtime, block-protocol
 ```
 
-The only build change needed: [`addUserBinary`](build.zig) currently takes exactly one
-module (`rt_mod`) and injects it. It should take a slice of modules. That's a
-five-line change, and it's the *entire* mechanism — Zig modules already give you
-everything else.
+The build side of this has since landed: [`addUserBinary`](build.zig) injects the
+default modules (`runtime`, `mmio`, `xkeyboard-config`, `acpi-ids`) into every user
+binary, and per-binary extras — protocol modules, bus logic — are added with
+`programModule(exe).addImport(...)`. That's the *entire* mechanism — Zig modules
+already give you everything else.
 
 The discipline that makes this work: **a class driver must not import a bus's logic
 module.** `usbhid` imports `proto.hid` and `usb` (for descriptor types), never `pci`.
@@ -132,20 +136,24 @@ If a class driver needs `mmio`, it has become an HCD and should be one.
   grants, `device_grant` teardown.
 - **M11** — `irq_bind` / `irq_ack`. IRQ delivered as an IPC notification; mask before
   EOI; `irq_ack` is the unmask.
-- **M12** — `parent` in `DeviceDesc`, `device_register` with resource containment.
+- **M12** — `parent` in `DeviceDescriptor`, `device_register` with resource containment.
 - **M13** — capability passing. `ipc_call` / `ipc_reply_wait` grew a `send_cap` argument
   and a `received_cap` return (r8): an endpoint travels with a message, installed into
   the receiver's handle table (shared, refcount-bumped — a copy, not a move). A full
   table fails `-ENOSPC` and does not half-deliver. This is the "open" primitive — a bus
   driver mints a per-device endpoint and hands it to a class driver. The runtime exposes
-  `callCap` and `replyWait(..., send_cap)`; no class driver consumes it yet.
+  `callCap` and `replyWait(..., send_cap)`, and class drivers consume them now: the
+  PS/2 keyboard and mouse drivers attach to ps2-bus this way, and `runtime.usb` /
+  `runtime.input` open their per-device and subscription channels with `callCap`.
 - **M14** — DMA memory + the memory-ordering layer. `/lib/mmio` gives drivers typed
   volatile access and `mb`/`rmb`/`wmb` (per-arch); `dma_alloc`/`dma_free` grant
   physically-contiguous, pinned, uncacheable, reclaim-on-teardown buffers with the
   physical address exposed (`pmm.allocContiguous`, a DMA arena, `mapUserDmaInto`).
   `dma_below_4g` caps the address for legacy engines; `dma_write_combining` is accepted
-  but falls back to coherent until PAT is programmed. The bus drivers use `/lib/mmio`;
-  no DMA driver consumes `dma_alloc` yet.
+  but falls back to coherent until PAT is programmed. The bus drivers use `/lib/mmio`,
+  and `dma_alloc` has real consumers now: the xHCI driver's rings and contexts,
+  usb-storage's command/status wrappers, virtio-gpu's virtqueue, and the fat
+  service's bounce buffer.
 - **M15** — interrupts for PCI devices, the MSI half. Discovery now gives every PCI
   function its 4 KiB ECAM config space as resource 0 (unblocking the capability walk
   with no new syscall), and `msi_bind(device_id, endpoint) -> address, data` allocates a
@@ -175,8 +183,11 @@ If a class driver needs `mmio`, it has become an HCD and should be one.
   the hardware and spawns each driver ([drivers.md](drivers.md)). Ungated for now — a
   spawn capability is future work.
 
-So: **bus drivers work now, and they're started by the device manager, not the kernel.**
-HCDs and class drivers do not work yet. Here is exactly why, and exactly what would fix it.
+So: **all three shapes work now, and they're started by the device manager, not the
+kernel.** The xHCI driver is the HCD-and-bus proof; the USB HID/storage and PS/2 class
+drivers reach their devices purely over IPC. What follows are the original design notes
+for the primitives that unblocked each shape — exactly why each was the blocker, and
+exactly what fixed it.
 
 ---
 
@@ -302,8 +313,10 @@ barrier, or per-arch inline asm — which is what `library/mmio.zig` should hide
 rather than an out-struct. The rest of this section is the original design note.*
 
 **The blocker, and it's a hard one.** No PCI device can take an interrupt today.
-[`addBars`](system/devices/acpi.zig) records `.memory` and `.io_port` BARs and never an
-`.irq`; there is no `_PRT` parsing anywhere in the tree. The HPET is the one exception —
+`addBars` (then in the kernel's ACPI discovery; BAR decode has since moved to the
+ring-3 pci-bus driver, `system/drivers/pci-bus/pci-bus.zig`) records `.memory` and
+`.io_port` BARs and never an `.irq`; there is no `_PRT` parsing anywhere in the tree.
+The HPET is the one exception —
 it advertises its own interrupt routing in its own registers, a privilege no ordinary
 device has.