docs: four directories, and a rule for when a thing leaves the roadmap

docs/ was ten files where a plan, a description, a guide and a bug report all
sat next to each other. It is now architecture/ (what SchOS is), plan/ (what it
will be), guides/ (how to work on it) and history/ (why it is like this), with
an index that states the one rule holding it together: when something is
finished it moves from plan/ to architecture/ and is rewritten as a description
of the thing rather than a record of building it.

A ticked checkbox says the work happened. It does not say what the work
*produced*, and six months later the checkbox is all that is left. The network
stack proved the point: finished, verified end to end, and for a month the only
description of it anywhere was a checkbox four levels of indentation deep.

So roadmap.md went from 534 lines to 181 -- nothing deleted, the done work
graduated. Seven subsystems that were finished and undescribed now have
descriptions: boot, kernel, syscalls, filesystem, networking, graphics, usb,
init. Every one ends with "What it does not do", which is the section that pays;
a document listing only strengths is marketing, and the reader who needs it most
is the one about to trip over a limitation nobody wrote down.

schfs.md still opened with "phases 1 through 3 1/2 are done, phase 4 is next"
long after all five had landed. It is a description now, with the phase record
and the hard-won bugs moved to history/.

Three corrections found on the way, all load-bearing:

  * projects/schcom/README.md claimed SCM_RIGHTS was done. There is no
    sendmsg/recvmsg in the kernel at all, and an entire GUI plan rested on it.
  * The root README said "No TCP/IP" months after the stack landed.
  * history/kernel.md sec.7 was marked "in progress" on a problem that process
    groups solved.

Also adds plan/1.0.md, which draws a finish line so the open list stops being
infinite, and marks schwm/ and schde/ superseded: in Wayland the compositor is
the window manager, so that split dissolves rather than being abandoned.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

kernel/arch/x86_64/mp.c

@@ -146,7 +146,7 @@ mpinit(void)
   // interrupt assignments. So ncpu is 1 on QEMU no matter what, and SMP is
   // silently never exercised there.
   //
-  // See docs/roadmap.md "Known broken" -- this is half of the SMP bug, and the
+  // See docs/architecture/boot.md -- this is half of the SMP bug, and the
   // reason the other half (AP startup triple-faulting) cannot be reproduced
   // under QEMU until the MADT is parsed.
   cprintf("Seems we are SMP, ncpu = %d\n",ncpu);

kernel/arch/x86_64/trap.c

@@ -133,7 +133,7 @@ trap(struct trapframe *tf)
     // General-purpose register dump. This used to be followed by ~25 lines
     // that walked musl's mallocng group/meta structures out of rax/rdi and
     // dumped the user stack -- scaffolding for the boot-crash investigation
-    // recorded in docs/architecture/kernel-history.md section 1. That
+    // recorded in docs/history/kernel.md section 1. That
     // investigation is closed and the underlying kernel bugs are fixed, so
     // the allocator-specific part is gone; the registers stay, since they are
     // useful for any fault.

kernel/drivers/bus/xhci/xhci.c

@@ -12,7 +12,7 @@
 //
 // (Licensing points the same way. The BSD stacks are BSD-2/3-clause, which is
 // compatible with Apache-2.0 -- Linux's drivers are GPL-2.0-only, which is
-// not. See docs/roadmap.md.)
+// not. See docs/guides/adding-a-driver.md.)
 //
 // Enumeration polls the event ring instead of using interrupts. That is not
 // laziness: pci_bind_all() runs from kmain() with interrupts disabled and no

kernel/drivers/gpu/vga/vga_fb.c

@@ -136,7 +136,7 @@ vga_disp_acquire(struct device *d, uint32 *stride_out)
   // At 800x600x32 this is 1.9 MB of a 4 MB arena meant for device rings, which
   // is tolerable only because nothing else large lives there yet. The real fix
   // is a contiguous page allocator, or reserving this at boot from the memory
-  // map -- which is work that belongs with the E820 change in docs/roadmap.md
+  // map -- which is work that belongs with the E820 change in docs/architecture/boot.md
   // §3b, since that is what stops the kernel pretending 224 MB exists.
   //
   // Allocated on first use rather than at boot on purpose: a machine that never

kernel/drivers/net/e1000/e1000.h

@@ -5,7 +5,7 @@
 // From Intel's public "PCI/PCI-X Family of Gigabit Ethernet Controllers
 // Software Developer's Manual" (317453). A public document with no licence on
 // what you write from it, which is why this is written rather than ported: see
-// docs/licensing.md and docs/roadmap.md §1.
+// docs/licensing.md and docs/guides/adding-a-driver.md.
 //
 // QEMU's `-device e1000` is an 82540EM and implements enough of the manual to
 // be worth targeting; it is also what the default `-net nic` gives you.

kernel/proc/proc.c

@@ -298,8 +298,8 @@ exit(int status)
   // this, sigsuspend() can never return for the right reason and the
   // parent hangs unconditionally). Signal delivery itself is verified
   // working (handler invocation + sigreturn round-trip is clean); mksh's
-  // own job-control bookkeeping has further gaps (see docs/architecture/
-  // kernel-history.md) that this alone doesn't fully resolve, but
+  // own job-control bookkeeping had further gaps (see docs/history/kernel.md
+  // §7) that this alone did not resolve, but
   // disabling it guarantees no progress, whereas leaving it enabled at
   // least allows the cases that don't hit those gaps to work.
   if (myproc()->parent)