docs+code: spell out aspace/vaddr/paddr per coding standards

Expand the abbreviations flagged in docs/coding-standards.md (names spelled
out in full unless an acronym) across the kernel, runtime, ABI, tests, and
docs:

  aspace -> address_space  (AspaceRef -> AddressSpaceRef, retainAspace ->
           retainAddressSpace, loaded_aspace -> loaded_address_space, the
           liveAspaceCount/aspaceDestroyCount test hooks, etc.)
  vaddr  -> virtual_address
  paddr  -> physical_address

The kernel test case and its serial markers are renamed to match:
aspace-refcount -> address-space-refcount (kernel dispatch string and
test/qemu_test.py case name kept in sync). Prose in docs uses the natural
"address space"/"virtual address"; backticked field/identifier references
use the code spelling.

Also expand the bare "AS" abbreviation in three ABI comments and reframe the
set_thread_pointer ABI/handler docs to lead with the arch-neutral concept
(user-space TLS thread pointer; x86_64 IA32_FS_BASE, aarch64 TPIDR_EL0)
rather than x86 FS-first, matching scheduler.zig's existing framing.

Foreign ABI names preserved: the ELF p_vaddr field and mmap/mmio remain.

Verified: zig build, zig build test, and the full 25-case QEMU guardrail
suite all green.

docs/README.md

@@ -107,7 +107,7 @@ Start with the north star:
 - **[threading.md](threading.md) — threads, the std-shaped way.** **Built** (M1–M6):
   `runtime.Thread` mirrors `std.Thread`'s API (spawn/join/detach, Mutex/Condition/
   Semaphore) over a **private** thread ABI — several tasks sharing one address space via
-  a `thread_spawn` syscall, futex-backed blocking, aspace refcounting. Why it's the
+  a `thread_spawn` syscall, futex-backed blocking, address-space refcounting. Why it's the
   native type and not literal `std.Thread` (the [private ABI](syscall.md)), and why
   threads stay a narrow opt-in against the [resilience](resilience.md) default. Build
   plan + gates: [threading-plan.md](threading-plan.md).

docs/display-v2-plan.md

@@ -62,7 +62,7 @@ is the only backend), and `zig build test` stays green.
 - [x] [abi.zig](../system/abi.zig): `shm_create` (34) / `shm_map` (35) syscalls + a
       `shm_test` service id. Handlers in process.zig: `shm_create(len)` allocates contiguous,
       zeroed, **cacheable** frames, wraps them in a refcounted object, installs a capability
-      handle, maps them into the caller's shm arena → returns vaddr + handle; `shm_map(cap)`
+      handle, maps them into the caller's shm arena → returns virtual_address + handle; `shm_map(cap)`
       maps the same physical pages into the receiver. Reclaimed on death (see below).
 - [x] The capability core (ipc-synchronous.zig) is now **kind-tagged**: `scheduler.Task`'s
       handle table holds `HandleObject{kind, ptr}`; `closeHandles` and `shareCapability`

docs/display-v2.md

@@ -77,9 +77,9 @@ deferred (docs/display.md, "What v1 does not do"). v2 builds it: the natural gen
 of M13 capability-passing from *endpoints* to *memory objects* —
 
 ```
-shm_create(len) -> {handle, vaddr}     // a shareable, page-aligned RAM region
+shm_create(len) -> {handle, virtual_address}     // a shareable, page-aligned RAM region
 … pass `handle` as the send_cap on an ipc_call …
-shm_map(cap)    -> vaddr                // the receiver maps the same physical pages
+shm_map(cap)    -> virtual_address                // the receiver maps the same physical pages
 ```
 
 The payoff is leverage: the **same** primitive unlocks **both** native GPU drivers *and*

docs/display.md

@@ -220,8 +220,8 @@ both are clean additions behind the interfaces v1 establishes.
   to render into its *own* buffer and hand the compositor a *reference*, not a stream of
   commands. That needs the missing cross-process shared-memory primitive — best built as
   the natural generalization of the existing M13 [capability passing](driver-model.md)
-  from *endpoints* to *memory objects* (`shm_create(len) → {cap, vaddr}`, pass `cap` on
-  an `ipc_call`, receiver `shm_map(cap) → vaddr`). v1 avoids it because server-owned
+  from *endpoints* to *memory objects* (`shm_create(len) → {cap, virtual_address}`, pass `cap` on
+  an `ipc_call`, receiver `shm_map(cap) → virtual_address`). v1 avoids it because server-owned
   surfaces already prove the whole pipeline.
 
 - **Runtime mode-setting (a native backend).** Detecting the EDID mode list and changing

docs/driver-model.md

@@ -240,8 +240,8 @@ once per page, maps writeback-cached, and never reveals a physical address.
 **The fix.**
 
 ```
-dma_alloc(len, flags) -> vaddr (rax), paddr (rdx)
-dma_free(vaddr, len)  -> 0
+dma_alloc(len, flags) -> virtual_address (rax), physical_address (rdx)
+dma_free(virtual_address, len)  -> 0
 
 flags:  dma_coherent  (1)  uncacheable; the default and the only one that's portable
         dma_wc        (2)  write-combining — needs PAT programmed; for framebuffers

docs/drivers.md

@@ -74,7 +74,7 @@ The driver syscall numbers (`system/abi.zig`) with the device types they carry
 |---|------|---------|
 | 11 | `device_enumerate(buf, max) -> total` | Snapshot the device table |
 | 12 | `device_claim(id) -> ok` | Take **exclusive** ownership |
-| 13 | `mmio_map(id, res_idx) -> vaddr` | Map a claimed device's register window |
+| 13 | `mmio_map(id, res_idx) -> virtual_address` | Map a claimed device's register window |
 | 14 | `irq_bind(id, res_idx, endpoint)` | Deliver that device's IRQ as a notification |
 | 15 | `irq_ack(id, res_idx)` | Re-arm the IRQ after servicing the device |
 | 16 | `device_register(parent_id, desc) -> id` | Publish a child of a device you claimed |

docs/threading-plan.md

@@ -105,28 +105,28 @@ first unchecked box.
 ## M1 — Address-space refcount (kernel foundation, no API, no behaviour change) ✅
 
 The one invariant change threads require, landed and proven **before** anything shares
-an address space. Today aspace is 1:1 with a task and teardown destroys it on any user
+an address space. Today address space is 1:1 with a task and teardown destroys it on any user
 task's exit; make destruction happen on the **last** exit.
 
 - [x] A refcount keyed by the address-space root, held in `scheduler.zig`
-      (`aspace_refs`): `retainAspace` takes a reference in `spawnUserLocked` (on the
+      (`address_space_refs`): `retainAddressSpace` takes a reference in `spawnUserLocked` (on the
       success path, after the slot + stack are secured), all under the big kernel lock.
 - [x] Both task-teardown paths ([scheduler.zig](../system/kernel/scheduler.zig):
       `exitUserLocked` and `destroyTaskLocked`) call `releaseAspace`, which decrements
       and only `destroyAddressSpace`s at **zero**; an unretained space (hand-built test
       spaces) is destroyed directly, preserving prior behaviour.
-- [x] `-Dtest-case=aspace-refcount`: spawn and reap several ring-3 processes in sequence
-      and assert (via test-observable `liveAspaceCount`/`aspaceDestroyCount`) that the
+- [x] `-Dtest-case=address-space-refcount`: spawn and reap several ring-3 processes in sequence
+      and assert (via test-observable `liveAddressSpaceCount`/`addressSpaceDestroyCount`) that the
       live-space count returns to **baseline** and destructions advance by exactly that
       many — each space destroyed exactly once, no leak, no double-free. (Refcount
       observables, not raw frame counts, since kernel stacks are still leaked on exit.)
 
-**Gate (met):** `python3 test/qemu_test.py aspace-refcount` passes
-(`aspace-refcount: spaces released to baseline ok` → `DANOS-TEST-RESULT: PASS`), and the
+**Gate (met):** `python3 test/qemu_test.py address-space-refcount` passes
+(`address-space-refcount: spaces released to baseline ok` → `DANOS-TEST-RESULT: PASS`), and the
 full guardrail set passes unchanged — 13/13 (`smoke`, `sched`, `priority`, `smp`,
 `affinity`, `process`, `process-kill`, `supervision`, `fault-recovery`,
 `vfs-client-death`, `ipc`, `ipc-cap`, `display-service`); default `zig build` clean,
-`zig build test` green. The reframing is invisible until an aspace is actually shared.
+`zig build test` green. The reframing is invisible until an address space is actually shared.
 
 ## M2 — `thread_spawn` + `thread_exit`: a thread runs in the shared address space ✅
 
@@ -135,7 +135,7 @@ space and exits cleanly.
 
 - [x] [abi.zig](../system/abi.zig): `thread_spawn = 37`, `thread_exit = 38`. Handlers in
       process.zig; `thread_spawn` calls `scheduler.spawnThread` (shares the caller's
-      aspace, `retainAspace`); `thread_exit` ends the task like a process `exit(0)`
+      address space, `retainAddressSpace`); `thread_exit` ends the task like a process `exit(0)`
       (`terminateCurrent` → `releaseAspace`). The closure pointer is delivered in the new
       thread's **rdi** via a new `jump_to_user_arg` asm path (`t.user_arg`, 0 for a
       process) — no naked runtime asm.
@@ -152,14 +152,14 @@ space and exits cleanly.
       address space.
 
 **Gate (met):** `python3 test/qemu_test.py thread-spawn` passes
-(`thread-test: child ran in shared aspace ok` → `DANOS-TEST-RESULT: PASS`); guardrail set
+(`thread-test: child ran in shared address space ok` → `DANOS-TEST-RESULT: PASS`); guardrail set
 16/16 green (incl. `args`/`init`/`process`, which exercise the new `jump_to_user_arg`
-process path with arg 0) plus `aspace-refcount`; `zig build` clean, `zig build test`
+process path with arg 0) plus `address-space-refcount`; `zig build` clean, `zig build test`
 green.
 
 > **Note (deferred to M3+):** the mmap arena is per-*task* (`heap_next`), so two threads
-> in one aspace that both `mmap` would collide. Fine for M2 (only the parent maps, for the
-> child's stack); make the arena per-aspace and the runtime heap thread-safe alongside the
+> in one address space that both `mmap` would collide. Fine for M2 (only the parent maps, for the
+> child's stack); make the arena per-address-space and the runtime heap thread-safe alongside the
 > `Mutex` work (M5).
 
 ## M3 — `join` + `detach` + real parallelism ✅
@@ -184,7 +184,7 @@ green.
 **Gate (met):** `python3 test/qemu_test.py thread-join` passes (`thread-test: join ok` →
 `DANOS-TEST-RESULT: PASS`), robust across 4 runs; guardrail 17/17 green (incl. `smp`,
 `affinity`, `process-kill`, and `args`/`init`/`process` on the exit-endpoint spawn path)
-plus `aspace-refcount`/`thread-spawn`; `zig build` clean, `zig build test` green.
+plus `address-space-refcount`/`thread-spawn`; `zig build` clean, `zig build test` green.
 
 > **Note (deferred):** a detached thread's stack is freed only at process exit (not by the
 > reaper on thread exit) — kernel user-stack tracking + reclaim is a later refinement. And
@@ -212,7 +212,7 @@ plus `aspace-refcount`/`thread-spawn`; `zig build` clean, `zig build test` green
 **Gate (met):** `python3 test/qemu_test.py thread-futex` passes, robust across 3 runs —
 the case's **ordered** regex asserts `waiting → waking → woke → PASS` on the serial
 stream (the handoff proof), and `thread-futex: timeout ok` confirms the timeout.
-Guardrail 18/18 green (incl. `sleep`/`event`/`ipc` blocking paths) + `aspace-refcount`,
+Guardrail 18/18 green (incl. `sleep`/`event`/`ipc` blocking paths) + `address-space-refcount`,
 `thread-spawn`, `thread-join`; `zig build` clean, `zig build test` green.
 
 > **Note:** the kernel test checks only the freshest verdict marker via `bufferHas` (the
@@ -293,9 +293,9 @@ The organising principle, so Phase 2 reinforces danos's goals rather than erodin
 
 - **Everything a thread owns is reclaimed on process death.** Thread stacks, TLS blocks,
   and futex words live in the process's **address space**, and the kernel's per-process
-  state is keyed by the aspace root — so the M1 refcount + `destroyAddressSpace` already
+  state is keyed by the address-space root — so the M1 refcount + `destroyAddressSpace` already
   free all of it when the last thread exits. A crashed or killed threaded process leaves
-  **nothing** behind. Phase 2 closes the one thing that is *not* aspace-owned — the
+  **nothing** behind. Phase 2 closes the one thing that is *not* address-space-owned — the
   per-task **kernel** stack (kernel heap) — with a reaper (M8). This is the
   [resilience](resilience.md) restart guarantee, extended to threads.
 - **Kernel owns mechanism; the runtime owns policy.** The kernel maps pages, saves/
@@ -313,9 +313,9 @@ threads in one process that both allocate corrupt each other. The thread *machin
 avoids this (closure on the stack, stacks mmap'd only by the spawner), but real
 multi-threaded code would hit it. Closed it:
 
-- [x] **Kernel — per-address-space mmap arena.** Grew M1's `aspace_refs` entry into the
+- [x] **Kernel — per-address-space mmap arena.** Grew M1's `address_space_refs` entry into the
       per-address-space object holding the `mmap`/`mmio` arena cursors (moved off `Task`);
-      `scheduler.aspaceMmapNextPtr`/`aspaceDeviceMapNextPtr` expose them. `systemMmap`
+      `scheduler.addressSpaceMmapNextPtr`/`addressSpaceDeviceMapNextPtr` expose them. `systemMmap`
       reserves a disjoint range under a *brief* lock, then maps **per page** under a
       short-held lock — not the whole grant — because the big lock is held with interrupts
       disabled, so pinning it across a multi-MiB memset+map froze other cores (it timed
@@ -359,7 +359,7 @@ death lost one, so a crash loop bled kernel memory. The reaper fixes it and serv
       stack reclaimed, no leak. Threads exit through the same `exitUserLocked`, so covered.
 
 **Gate (met):** `task-reap` passes (5× isolated + 2× in the full batch); `fault-recovery`,
-`supervision`, `process-kill`, `aspace-refcount`, `smp`, `affinity` all still green (24/24
+`supervision`, `process-kill`, `address-space-refcount`, `smp`, `affinity` all still green (24/24
 full guardrail); `zig build`/`zig build test` clean.
 
 > **Bug found + fixed here (touches every context switch):** the post-`switchContext` reap
@@ -397,7 +397,7 @@ guardrail 26/26 (incl. `process-kill`, `supervision`, `fault-recovery`, `task-re
 
 > **Deferred:** detached-thread **user-stack** reclaim (still freed at process exit, as in
 > M3). Doing it in the reaper needs the saved address space + stack range and a
-> translate/unmap in a not-currently-loaded aspace — real complexity for a bounded leak.
+> translate/unmap in a not-currently-loaded address space — real complexity for a bounded leak.
 > A follow-up when a consumer needs it.
 
 ### M10 — Per-thread TLS: the `fs.base` mechanism ✅
@@ -456,7 +456,7 @@ clean.
 
 ## Deferred (explicitly not in this plan)
 
-- **Cross-process shared-memory futex** — the `(aspace, vaddr)` key can become a
+- **Cross-process shared-memory futex** — the `(address_space, virtual_address)` key can become a
   physical-address key so two processes share a futex through an [shm](display-v2.md)
   region. Not needed for intra-process threads.
 - **Per-thread priorities / affinity distinct from the process** — threads inherit the

docs/threading.md

@@ -148,10 +148,10 @@ Plus one invariant change with no new syscall: **address-space reference countin
 
 ### Address-space reference counting
 
-Today an address space is 1:1 with a task: `spawnUserLocked` records `aspace` on the
-Task, and teardown does `destroyAddressSpace(t.aspace)` when **any** user task exits
+Today an address space is 1:1 with a task: `spawnUserLocked` records `address_space` on the
+Task, and teardown does `destroyAddressSpace(t.address_space)` when **any** user task exits
 ([scheduler.zig](../system/kernel/scheduler.zig)). With threads, several tasks share
-one `aspace`, so the first to exit would rip the address space out from under its
+one `address_space`, so the first to exit would rip the address space out from under its
 siblings.
 
 Fix: a small refcount keyed by the address-space root (`createAddressSpace` in
@@ -162,7 +162,7 @@ that must land and be proven before anything shares an address space.
 
 ### `thread_spawn` and the trampoline
 
-The scheduler already accepts an arbitrary `aspace` and does **not** smuggle values
+The scheduler already accepts an arbitrary `address_space` and does **not** smuggle values
 through registers — `startUserTask` reads the entry/stack from the Task and
 `jumpToUser`s ([scheduler.zig](../system/kernel/scheduler.zig)). That makes the thread
 path clean:
@@ -171,7 +171,7 @@ path clean:
    `{ fn_ptr, args_tuple, completion }`, the std "Instance" pattern — and writes the
    closure pointer to the **top word of the new stack**.
 2. It calls `thread_spawn(entry = &threadTrampoline, stack_top, arg = closure_ptr)`.
-   The kernel calls the same `spawnUserLocked` path with the **caller's aspace**
+   The kernel calls the same `spawnUserLocked` path with the **caller's address space**
    (refcount++), `entry`, and `user_sp = stack_top`.
 3. `threadTrampoline` (a small runtime shim) reads the closure off its stack, calls
    the user function, then calls `thread_exit`. No new register ABI — the closure
@@ -185,7 +185,7 @@ Unlike a process start, there is **no** System V argc/argv/auxv block
 
 - **`thread_exit`** marks the task dead and hands the kernel the thread's user-stack
   range. The kernel reaps the task on the scheduler (already running on a *kernel*
-  stack, so it can safely unmap the user stack), decrements the aspace refcount, and
+  stack, so it can safely unmap the user stack), decrements the address-space refcount, and
   frees the task slot.
 - **`join` — Stage 1** reuses the existing exit-notification machinery
   ([process-lifecycle.md](process-lifecycle.md)): `spawn` passes a per-thread
@@ -206,12 +206,12 @@ Unlike a process start, there is **no** System V argc/argv/auxv block
 call the futex wrappers on the slow path — the same construction `std.Thread` uses,
 so the algorithms port directly.
 
-Keying: threads share an address space, so a **virtual address within that aspace**
-identifies a futex uniquely; the kernel keys its wait queue by `(aspace_root, vaddr)`.
-Keying by the **physical** address instead (translate `vaddr -> paddr` on entry) is a
+Keying: threads share an address space, so a **virtual address within that address space**
+identifies a futex uniquely; the kernel keys its wait queue by `(address_space_root, virtual_address)`.
+Keying by the **physical** address instead (translate `virtual_address -> physical_address` on entry) is a
 deliberate forward door: it lets two *processes* share a futex through an
 [shm](display-v2.md) region later, without changing the API. We start with the
-private-per-aspace key and note the physical-key upgrade.
+private-per-address-space key and note the physical-key upgrade.
 
 No spinning: a contended lock parks the task in the kernel and the core is free to run
 other work or `hlt` ([halting.md](halting.md)). This is why futex is a locked
@@ -238,14 +238,14 @@ it may call `runtime.Thread.spawn`. Everyone else stays single-threaded and lean
 ## Interaction with the rest of the kernel
 
 - **Scheduler / SMP** ([scheduling.md](scheduling.md), [smp.md](smp.md)): a thread is
-  just another `Task` with an `aspace` shared with its siblings; the existing
+  just another `Task` with an `address_space` shared with its siblings; the existing
   per-core ready queues, priorities, and affinity apply unchanged. Threads of one
   process can run on different cores simultaneously — that is the point.
 - **Halting** ([halting.md](halting.md)): futex-parked waiters keep the "idle core
   halts" property intact under lock contention — no busy-wait.
 - **Lifecycle** ([process-lifecycle.md](process-lifecycle.md)): killing a process
-  must kill *all* its threads and only then drop the last aspace ref. The kill path
-  already targets a process; it fans out to every task on that aspace.
+  must kill *all* its threads and only then drop the last address-space ref. The kill path
+  already targets a process; it fans out to every task on that address space.
 - **Resilience** ([resilience.md](resilience.md)): a faulting thread kills its whole
   process (shared fate). The supervisor restarts the **process**, which respawns its
   threads from a known-good state — restart granularity stays the process.
@@ -258,8 +258,8 @@ The ordered, `/loop`-runnable milestones live in
 a verifiable gate (`python3 test/qemu_test.py <case>`, asserting serial markers;
 `zig build test` for host unit tests). The stages below are the shape it expands.
 
-- **Stage 0 — address-space refcount.** Refcount on the aspace root; teardown destroys
-  at zero. No API yet; nothing shares an aspace, so refcount is 1 everywhere.
+- **Stage 0 — address-space refcount.** Refcount on the address-space root; teardown destroys
+  at zero. No API yet; nothing shares an address space, so refcount is 1 everywhere.
   *Gate:* the full QEMU suite stays green (no regression) — proves the reframing is
   invisible until used.
 - **Stage 1 — spawn / join / detach.** `thread_spawn` + `thread_exit`, the trampoline,
@@ -293,7 +293,7 @@ are — user code never names a syscall.
 - **No thread priorities distinct from the process.** Threads inherit the process
   priority; per-thread priority is a later question if it ever earns its keep.
 - **No cross-process shared-memory futex yet** — the physical-address key leaves the
-  door open, but the first cut is private-per-aspace.
+  door open, but the first cut is private-per-address-space.
 - **No `pthread`/POSIX surface.** The API is `std.Thread`-shaped Zig, nothing more.
 
 ## The self-hosting endgame

docs/vdso.md

@@ -119,7 +119,7 @@ One table entry per kernel call, C ABI (System V AMD64), names prefixed
 returns are `u64`, errors return as negative values exactly as today.
 
 The calls that return two values in `rax:rdx` today — `dma_alloc`
-(vaddr + paddr), `msi_bind` (address + data), `shm_create` (vaddr + handle) —
+(virtual_address + physical_address), `msi_bind` (address + data), `shm_create` (virtual_address + handle) —
 become functions returning a two-`u64` struct. The System V ABI returns a
 16-byte struct in `rax:rdx`, so the stub is a plain `syscall; ret` — the
 C-ABI spelling of the existing convention, at zero cost.