library: the harness keeps the subscribers, and an id belongs to whoever opened it

Three services had each written the same thing and got it three different
ways: input polled the process list to notice a dead subscriber, and only
when someone else subscribed; the power service never noticed at all; the
device manager noticed drivers but not subscribers. The harness owns the
table now, driven by the events a protocol declares — it registers on the
reserved verb, frames each event once, posts to everyone interested without
waiting on any of them, and reclaims a slot when the kernel says its owner
died. Interest masks moved to the envelope, so a subscriber that wants only
mice asks the same way everywhere.

Two consequences the plan had not foreseen. The device manager now hears a
supervised child's death twice, once as its supervisor and once as a
subscriber, so restart backoff counted every crash twice and gave up after
half as many; it retires the id before counting. And the kernel's published
exit table had eight slots for what is now six subscriptions in a plain
boot, so it holds sixteen.

The other half is a hole the design named early and left standing: a
backend handed out a small integer and then honoured it from anyone. A
process that guessed a file's node id read another client's file; a display
layer had no owner at all, so any client could reconfigure or destroy any
layer; a USB device token was never checked against the client that opened
it. Each is now bound to the task that opened it, and a wrong owner gets
exactly what an unknown id gets — the refusal must not become the oracle
the identical answers elsewhere were designed to remove. Closing a file
changed with it: it used to succeed unconditionally, which would have told
a caller which ids existed.

Suite 111/111, with a new case in which one process holds a file and a
layer, hands both ids to a second process, and finds them untouched after
that process has tried everything with them.

system/drivers/usb-xhci-bus/usb-xhci-library.zig

@@ -1498,6 +1498,24 @@ pub const Controller = struct {
         return true;
     }
 
+    /// Stop reporting for `device_token`: deactivate every subscription tagged
+    /// with it, so no further report is queued and the slot can be reused. Called
+    /// when the class driver that owned the token dies — its endpoint handle is
+    /// closed with it, and a queued report would then be aimed at a handle number
+    /// the bus driver has since given to something else. In-process hub
+    /// subscriptions carry no token and are never touched.
+    ///
+    /// One completion may already be in flight; it finds no active subscription
+    /// and is dropped as a foreign transfer event, which is exactly what it is.
+    pub fn releaseSubscriptions(self: *Controller, device_token: u64) void {
+        for (&self.subscriptions) |*subscription| {
+            if (!subscription.active or subscription.hub != null) continue;
+            if (subscription.device_token != device_token) continue;
+            subscription.active = false;
+            subscription.report_endpoint = 0;
+        }
+    }
+
     // Arm (or re-arm) a subscription's endpoint with a Normal TRB pointing at its
     // report buffer, and ring the endpoint's doorbell so the controller polls it.
     fn armInterrupt(self: *Controller, subscription: *Subscription) void {