docs: the tree moved and the documentation did not

The site and several documents still described the system as it was before
virtual terminals, the new schinit, the hybrid work and descriptor passing.

docs/architecture/init.md described the wrong program. It documented a single
schinit that parses manifests and supervises jobs, which has not been true since
PID 1 was split: PID 1 forks a supervisor, spawns jobs on its behalf and reaps;
the job table lives in /proc/schinit; a heartbeat runs both ways; and
proc_reincarnate() re-execs PID 1 in place rather than panicking. Rewritten
around what exists, keeping the reasoning that is still load-bearing -- the five
failures of the sibling-init scheme, the escalation ladder, and the three bugs in
the reincarnation path that each had to happen before they were obvious.

docs/plan/init.md is deleted, which is the tree's own rule for finished work and
had not been applied. Fourteen source comments referenced it by part number, so
they are repointed at the architecture doc by section name rather than left
dangling -- a deleted document nobody notices is worse than a stale one.

docs/architecture/devices.md gained the section it has been missing since
/dev/pci existed: what a driver needs from a kernel, why mmap is checked against
the caller's claims, why DMA is a call and not a mapping, and why the write back
after an interrupt is not optional. Also that a released device does not come
back by itself, which is true and was nowhere.

docs/architecture/networking.md gained a descriptor-passing section, and
docs/architecture/README.md's stack diagram gained the two layers and the third
seam it was missing. "Two seams hold the whole thing together" has not been true
since /dev/pci.

docs/plan/README.md said the hybrid work was deliberately last, on the argument
that an interface with no consumer is wrong in ways nobody can see. The argument
was right; the conclusion was not, and the document now says why it changed --
the alternative to a driver compatibility layer is writing a driver for every
device that exists, and the original objection is answered rather than ignored
because SchOS's own drivers are the consumers.

The site: a Hybrid section with the eviction transcript, cards for virtual
terminals, schinit and drivers outside the kernel, and the numbers remeasured
rather than estimated -- 46,961 lines, 207 syscalls. The boot log in app.js is
from a boot taken today, and the lines are trimmed to what the console can show
without clipping, each still a verbatim prefix of real output.

Two small rendering fixes found by looking at the pages rather than assuming:
.console pre's min-height is now scoped to the hero, so a static transcript sizes
to its content instead of reserving eight lines it does not have; and the docs
reader's contents panel strips inline marks from headings, so a heading written
`proc_reincarnate()` no longer carries its backticks into the sidebar.

Every intra-doc link checked; none broken.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

cmd/schinit/main.c

@@ -7,7 +7,7 @@
 // now lives in schinitd (PID 2), and what is left here is deliberately, almost
 // aggressively small.
 //
-// The reason is docs/plan/init.md, and it is worth restating because the
+// The reason is docs/architecture/init.md, and it is worth restating because the
 // smallness looks like an accident otherwise:
 //
 //   **PID 1 is the one program on the machine with no supervisor.** Nothing
@@ -211,7 +211,8 @@ bootstrap(void)
 
 // Publish what PID 1 is holding.
 //
-// docs/plan/init.md part 2: the state lives outside whichever process is
+// docs/architecture/init.md, "State outside the process": it lives outside
+// whichever process is
 // supervising, so a restarted supervisor can read the world back instead of
 // rebuilding it. It is written by PID 1 because PID 1 is the process that
 // cannot lose it.
@@ -613,7 +614,7 @@ main(int argc, char *argv[])
         // The heartbeat. A supervisor that has stopped answering is stuck,
         // and a stuck supervisor is indistinguishable from a working one by
         // any means except asking it something -- which is the whole reason
-        // this exists. See docs/plan/init.md part 3.
+        // this exists. See docs/architecture/init.md, "The heartbeat".
         if (sock >= 0) {
             int now = uptime();
             if (now - last_ping >= SCHINIT_PING_SECS * 100) {

cmd/schinitd/main.c

@@ -4,7 +4,7 @@
 //
 // Everything that used to make PID 1 complicated lives here: reading
 // /etc/schinit, parsing manifests, deciding what runs, respawn policy and
-// throttling. docs/plan/init.md calls this "where the bugs will be", which is
+// throttling. docs/architecture/init.md calls this "where the bugs will be", which is
 // exactly why it is a separate program -- a bug here is a restart, not a panic.
 //
 // The one rule that makes the split worth having:
@@ -16,7 +16,7 @@
 //
 // A supervisor that forked its own children could not be restarted without
 // either losing them to reparenting or racing the new copy to adopt them --
-// the split-brain failure docs/plan/init.md rejects the two-init scheme for.
+// the split-brain failure docs/architecture/init.md rejects the two-init scheme for.
 
 #include "types.h"
 #include "user.h"
@@ -482,7 +482,7 @@ note_exit(unsigned int cookie, int pid, int status)
 
 // Read /proc/schinit and claim the jobs PID 1 is already holding.
 //
-// This is the half of docs/plan/init.md part 2 that makes the other half worth
+// This is the half of "State outside the process" that makes the other half worth
 // anything. PID 1 publishes the table; without this, a restarted supervisor
 // reads its manifests, sees nothing running *as far as it knows*, and starts
 // everything a second time. The console shell then exists twice, both reading
@@ -644,7 +644,7 @@ main(void)
         //
         // There is nothing this program can do about it -- PID 1 cannot be
         // killed and cannot be replaced from here -- so it says so, loudly,
-        // once. docs/plan/init.md is explicit that this is the limit: a hang
+        // once. docs/architecture/init.md is explicit that this is the limit: a hang
         // in PID 1 is only caught by noticing, and if both ends are wedged at
         // once nothing catches it. There is no hardware watchdog.
         //