docs: full docs-vs-code audit — fix every stale claim across 40 docs

Every doc verified claim-by-claim against the code by parallel audit agents,
then fixed and adversarially re-verified. Two waves of staleness corrected:
the originally audited findings (higher-half boot handoff, kernel VFS
takeover, fault isolation + claim release + driver restart, AML/S5 moving to
ring 3, threading's shipped design, USB+FAT landing) and a second pass of
adjacent claims the verifiers caught (smp.md 'not built yet' intro,
system-requirements' PS/2-only and no-storage claims, halting.md's red-panic
and no-IDT text, testing.md's serial mirroring, router-era vfs-protocol
wording, capsule-first boot loading).

threading.md now documents the shared-fate gap explicitly: the design says a
process dies whole, the kernel today kills only the offending thread.

Also fixes three stale code comments (isr.s exceptionHandler, acpi.zig
sleepValue, build.zig boot-volume) — comments only, no behavior change.

docs/interrupts.md

@@ -9,8 +9,10 @@ reboot is miserable.
 
 This is the machinery that catches those faults and prints what happened instead.
 It's all x86_64-specific, so it lives behind the [architecture](architecture.md) boundary in
-`system/kernel/architecture/x86_64/`. Only the 32 CPU-defined exception vectors are wired up so far;
-device interrupts (timer, keyboard, via the APIC) come later, on the same IDT.
+`system/kernel/architecture/x86_64/`. Only the 32 CPU-defined exception vectors were wired up at
+this stage; device interrupts (timer, keyboard, via the APIC) came later, on the
+same IDT — today it installs 48 gates (vectors 0-47) plus the ring-3 syscall gate
+at vector 128.
 
 ## First the GDT
 
@@ -20,9 +22,11 @@ IDT gate names a code-segment *selector* that must resolve in the current GDT. T
 firmware left a GDT in place, but we don't control it, so we install our own with
 known selectors: `0x08` kernel code, `0x10` kernel data.
 
-`system/kernel/architecture/x86_64/gdt.zig` holds three flat descriptors — a required null entry,
-plus code and data — where the only bits that matter in long mode are the access
-byte and the code segment's long-mode (`L`) flag. Loading it (`gdt_flush` in
+`system/kernel/architecture/x86_64/gdt.zig` held three flat descriptors at this point — a required
+null entry, plus code and data — where the only bits that matter in long mode are
+the access byte and the code segment's long-mode (`L`) flag. (The table has since
+grown to seven entries: ring-3 user data and user code descriptors arrived with
+user mode, and the TSS descriptor — below — spans two slots.) Loading it (`gdt_flush` in
 `isr.s`) does two things: `lgdt`, then reload the segment registers. The data
 registers take a plain `mov`, but **CS can't** — so we reload it with a far
 return, pushing the new selector and a return address and letting `lretq` pop them
@@ -34,7 +38,8 @@ The **Interrupt Descriptor Table** maps each of 256 vectors to a handler. Each
 entry is a 16-byte *gate* holding the handler's address (split across three
 fields, a quirk of the format), the code selector (`0x08`), and flags: `0x8E`
 means present, ring 0, 64-bit interrupt gate. `system/kernel/architecture/x86_64/idt.zig` builds the
-table, points the first 32 vectors at their stubs, and loads it with `lidt`
+table, points the first 32 vectors at their stubs (since grown to gates 0-47,
+plus the ring-3 syscall gate at vector 128), and loads it with `lidt`
 (`idt_flush`).
 
 ## The TSS and the double-fault stack
@@ -52,9 +57,11 @@ third time and **triple-fault** — an instant reset. So the #DF gate is pointed
 **IST1**, a small dedicated stack (`system/kernel/architecture/x86_64/tss.zig`) that's always valid.
 
 Bringing it up: fill in the TSS's IST1 pointer, publish the TSS through a
-descriptor in the GDT (`gdt.setTss`), and load it into the task register with
+descriptor in the GDT (`gdt.setTssFor`), and load it into the task register with
 `ltr`. The TSS descriptor is a 16-byte system descriptor spanning two GDT slots,
-which is why the GDT grew from three entries to five.
+which is why the GDT grew from three entries to five (and later to seven, when
+user mode slotted the ring-3 user data/user code descriptors between the kernel
+data entry and the TSS pair).
 
 ## The stubs and the trap frame
 
@@ -74,12 +81,12 @@ push order in `isr.s`; the two must stay in sync.
 The stubs and table-loads are real assembly rather than Zig inline asm because
 they need things inline asm on this toolchain can't express: cross-symbol
 `jmp`/`call` (a stub jumping to `isr_common`, which calls the exported
-`exceptionHandler`), and the `lgdt`/`lidt` memory operands (which LLVM rejects
+`interruptDispatch`), and the `lgdt`/`lidt` memory operands (which LLVM rejects
 inline). `build.zig` adds `isr.s` to the arch module.
 
 ## Reporting a fault
 
-`isr_common` calls `exceptionHandler`, which forwards to a swappable `on_fault`
+`isr_common` calls `interruptDispatch`, which forwards to a swappable `on_fault`
 hook. The generic kernel installs a reporter (`onException` in `kernel.zig`) that
 prints the exception name and vector, the error code, the faulting RIP
 and RSP, and — for a page fault (#PF, vector 14) — the faulting address from