ldls: L4 was free after all, and the plan closes

L4 was listed as "free -- H2 built all of this" and never actually tested,
which is a claim rather than a result. Tested now, and it holds:

    ldlsd running     ping 2/2; holds index 7 and DMA slots 3 and 4
    killed            interface DOWN, device released, bus mastering
                      cleared, DMA reclaimed -- back to vgpud's 3 blocks
    ping              fails honestly: sendto: -5
    a second ldlsd    ping 3/3, and the arena hands back the same addresses

pciuser_release_all() and netuser_release_all() sit beside each other in
exit() for the same reason, and that they apply unchanged to a foreign driver
is the whole point of having built them against our own.

With that, every milestone on ldls.md is done, so it leaves docs/plan/ for
docs/architecture/ -- the rule docs/plan/README.md states and the one that
keeps the two directories meaning different things. The new document describes
what is, not what was planned: the five rules, the four pieces, what it costs
(polling, no stack protector, locks that are no-ops), that it can be killed,
and a "what it does not do" that leads with one driver, one kernel version,
tried once.

Sixteen source files pointed at docs/plan/ldls.md and would have been dangling
the moment it moved. All repointed, and the milestone references -- which the
architecture doc deliberately does not have -- rewritten to name sections
instead, so a reader lands somewhere real.

The register row closes with it. hybrid.md freed a slot, ldls.md took it, and
it is now free again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VQ7Qx8E1q1M1bbCq8QLHS2

cmd/ldlsd/main.c

@@ -2,7 +2,7 @@
 //
 // ldlsd -- LDLS, on SchOS.
 //
-// docs/plan/ldls.md milestone L3b. `ldls-run` did this on the build machine so
+// docs/architecture/ldls.md. `ldls-run` does this on the build machine so
 // that loader failures cost a second instead of a boot; this is the same
 // loader, the same BTF reader and the same trampolines, in a process on the
 // system they were written for.
@@ -96,7 +96,7 @@ streq(const char *a, const char *b)
 // buffers (a kernel's BTF is several megabytes) and memory it can execute --
 // which on SchOS is every mapping, because the kernel never sets EFER.NXE.
 // That is convenient here and is a gap rather than a feature; see the note in
-// docs/plan/ldls.md.
+// docs/architecture/ldls.md.
 //
 // The module lands in the low 2 GB automatically: a process's mmap area starts
 // at 0x40000000 and bumps upward, which is exactly the window R_X86_64_32S

cmd/netecho/main.c

@@ -2,8 +2,9 @@
 //
 // netecho -- a network, in a process.
 //
-// docs/plan/ldls.md L3a. `/dev/netdev` lets a process be a network interface;
-// this is the program that proves it, and it is deliberately *not* a driver.
+// docs/architecture/ldls.md, "The class bridge". `/dev/netdev` lets a process
+// be a network interface; this is the program that proves it, and it is
+// deliberately *not* a driver.
 // It has no hardware, claims none, and answers every frame itself:
 //
 //   DHCP    so the interface gets an address at all -- lwIP asks the moment
@@ -12,8 +13,8 @@
 //   ARP     so the stack can find us
 //   ICMP    so `ping 10.9.0.1` answers
 //
-// Why a fake network and not the Linux driver straight away: the two halves of
-// L3 fail differently. If `ping` does not work with this, the bridge is wrong.
+// Why a fake network and not the Linux driver straight away: the two halves
+// fail differently. If `ping` does not work with this, the bridge is wrong.
 // If it works with this and not with a driver, the driver's side is wrong. A
 // test that can only fail in one lump tells you nothing about which half.
 //