docs: full docs-vs-code audit — fix every stale claim across 40 docs

Every doc verified claim-by-claim against the code by parallel audit agents,
then fixed and adversarially re-verified. Two waves of staleness corrected:
the originally audited findings (higher-half boot handoff, kernel VFS
takeover, fault isolation + claim release + driver restart, AML/S5 moving to
ring 3, threading's shipped design, USB+FAT landing) and a second pass of
adjacent claims the verifiers caught (smp.md 'not built yet' intro,
system-requirements' PS/2-only and no-storage claims, halting.md's red-panic
and no-IDT text, testing.md's serial mirroring, router-era vfs-protocol
wording, capsule-first boot loading).

threading.md now documents the shared-fate gap explicitly: the design says a
process dies whole, the kernel today kills only the offending thread.

Also fixes three stale code comments (isr.s exceptionHandler, acpi.zig
sleepValue, build.zig boot-volume) — comments only, no behavior change.

docs/vfs-protocol.md

@@ -7,10 +7,11 @@
 > redirects the caller to the owning backend's endpoint plus the rewritten
 > mount-relative path — after which the client speaks THIS protocol to the
 > backend, unchanged. The Zig source of truth is `system/vfs-protocol.zig`
-> (the `vfs-protocol` module), whose unit tests pin the sizes and values
-> below. This page is the **language-neutral wire specification** of that
-> contract — what a Rust or C client implements ([vdso.md](vdso.md) explains
-> why the IPC protocols, not the syscall numbers, are danos's public ABI).
+> (the `vfs-protocol` module), whose unit test pins a sample of the sizes
+> and values below. This page is the **language-neutral wire specification**
+> of that contract — what a Rust or C client implements ([vdso.md](vdso.md)
+> explains why the IPC protocols, not the syscall numbers, are danos's
+> public ABI).
 
 ## Transport
 
@@ -57,16 +58,20 @@ exit events.
 | 16 | 4 | `len` | reply payload length in bytes |
 | 20 | 4 | — | padding |
 
-On failure the router replies `status = -1`; a mounted backend's negative
-status is forwarded to the client verbatim. A richer errno vocabulary is
-future work — clients must treat *any* negative status as failure, not match
-on -1.
+On failure the backend replies `status = -1`, and that reply reaches the
+client directly — there is no party between them on the wire. (Kernel-served
+paths produce no wire replies at all: `fs_resolve`/`fs_node` failures are
+syscall register statuses.) A richer errno vocabulary is future work —
+clients must treat *any* negative status as failure, not match on -1.
 
 ## Operations
 
 Values are append-only and never renumbered (the same evolution rule every
-danos protocol follows); an unrecognised operation gets a `status = -1`
-reply.
+danos protocol follows). Send only values from this table: the shipped server
+decodes the operation into an exhaustive enum, so an out-of-range value is
+not answered with a `status = -1` reply — it trips a safety check in safe
+builds and is undefined otherwise. (The `-1` replies cover recognised but
+refused operations, such as `mount` sent to a backend.)
 
 | value | operation | request payload | reply |
 |------:|-----------|-----------------|-------|
@@ -84,10 +89,12 @@ reply.
 
 Notes per operation:
 
-- **open** — paths are absolute (`/mnt/usb/notes.txt`) or bare names
-  (`greeting`); bare names resolve in the VFS's flat ramfs, absolute paths
-  route through the mount table (below). The returned `node` is an id in the
-  *router's* open table; clients never see a backend's own ids.
+- **open** — the path is the mount-relative path `fs_resolve` handed back
+  (absolute-shaped: `/notes.txt` under fat's `/mnt/usb` mount). Bare names
+  (`greeting`) resolve nowhere — the flat ramfs is retired, and `fs_resolve`
+  refuses non-absolute paths. The returned `node` is the *backend's* own
+  open-node id: with the router in the kernel there is no forwarding table,
+  and clients hold backend ids directly (see *Lifetimes and trust*).
 - **read / write** — a single exchange moves at most 224 bytes
   (`maximum_payload`); the client loops, advancing `offset` by the returned
   `len`, until done (read) or the slice is written (write). A `write` reply
@@ -105,8 +112,12 @@ Notes per operation:
   the longest matching prefix wins, and an optional backend-side rewrite
   prefix maps a mount into the backend's namespace (fat serves `/mnt/usb`
   from its volume root and `/var` from its `/var` subtree).
-- **rename** — same-directory rename only (the router requires old and new to
-  resolve under one mount).
+- **rename** — same-directory rename only: the backend compares the old and
+  new parent paths and refuses a mismatch. The client (`runtime.fs`) refuses
+  earlier when the two paths resolve to different backend endpoints, but that
+  check is coarser than "one mount" — one endpoint can serve several mounts
+  (fat serves `/mnt/usb` and `/var`), so a cross-mount rename reaches the
+  backend and fails on its same-directory check.
 
 ## Open flags
 
@@ -156,11 +167,12 @@ table can grow.
 
 ## Lifetimes and trust
 
-Open-node ids live in the server. A client that dies without closing leaks
-nothing permanently: the VFS subscribes to the kernel's published process-exit
-events (docs/process-lifecycle.md) and releases a dead client's handles,
-closing forwarded backend nodes best-effort. Ids are plain integers, not
-capabilities — the VFS trusts its callers with each other's ids today, which
+Open-node ids live in the backend. A client that dies without closing leaks
+nothing permanently: the backend (the FAT server) subscribes to the kernel's
+published process-exit events (docs/process-lifecycle.md) and releases a dead
+client's handles. The kernel VFS root needs no sweep at all — its node tokens
+are permanent for a boot and carry no open state. Ids are plain integers, not
+capabilities — a backend trusts its callers with each other's ids today, which
 is acceptable while every client is part of the system image and worth
 revisiting (per-client id namespaces) before third-party binaries arrive.
 
@@ -169,8 +181,10 @@ revisiting (per-client id namespaces) before third-party binaries arrive.
 What a non-Zig implementation may rely on, and what it must not:
 
 - Operation values, flag bits, `NodeKind` values, and struct layouts are
-  **append-only and frozen once shipped** — the unit tests in `protocol.zig`
-  pin them exactly so a refactor can't silently move them.
+  **append-only and frozen once shipped**. The unit test in
+  `system/vfs-protocol.zig` pins a sample of them (the `DirectoryEntry`
+  size, `NodeKind` 0–1, `Operation` values 0, 4 and 5); this page is the
+  full record of the frozen values.
 - The 256-byte message ceiling is a property of the current IPC transport,
   not a promise; clients should read `maximum_payload`-shaped limits from the
   reply lengths they actually get (loop-until-done), not hard-code 224.