usb: the xHCI controller arrives by delegation, not by claiming

The first driver to stop claiming its own hardware. The device manager holds
the controller and transfers it in the hello reply, so its matching becomes
authoritative instead of advisory — until now the driver claimed the id it
found in argv[1], and any process could have claimed the same integer first.

The manager claims before it spawns, so there is no window in which anything
else could take the device, and transfers in onHello using invocation.sender
— the kernel-stamped task id, which cannot be forged by the caller. hello is
synchronous, so the transfer has completed before the reply lands: no gap
between being told yes and holding the thing.

usb-xhci-bus's hello moves from after controller bring-up to before anything
that needs the device, which is the bring-up reorder the design predicted.
It is the first member of an explicit delegated set, so every unconverted
driver keeps claiming exactly as before and the suite stays green; the set
and device_claim both go at D6. D3 and D4 could not be separated and the
plan records why: the moment the manager claims, any driver still calling
device_claim is refused, and D3 applied to nothing changes no behaviour and
cannot be tested.

This step introduced a regression and the incremental conversion is what
caught it. confineDevice runs inside systemDeviceClaim, so a device arriving
by transfer was never confined for its new owner. Three IOMMU+USB cases
failed on the driver's DMA rings going unbound, and two worse consequences
were latent: a manager death would have torn down a domain a live driver was
using, and a driver death would have leaked one. iommu.reassign now moves
the confinement with the device, keeping the domain and its attachment
intact so it never translates through nothing. Converting all five drivers
at once would have produced the same three failures with five suspects.

A log line of mine claimed "holding controller device N" before anything
verified it — it printed even in the failure case, where the driver held
nothing. Reworded to state only what is known there: where the registers
are.

usb-hid asserts the delegation with the device id backreferenced, so the id
delegated and the id the driver ends up with must match. Emptying the
delegated set fails it with "hello acknowledged" then "mmio_map failed".

usb-hub failed once in a full run and has passed six times since (four
isolated, two full) — recorded in the plan as a suspected instance of the
known intermittent AP fault, not dismissed, since this step did shift boot
timing.

Suite 118/118.

system/kernel/iommu.zig

@@ -200,6 +200,26 @@ pub fn unmapRegionEverywhere(physical: u64, len: u64) void {
 /// A driver died or released its devices: tear down every domain it held (detach the
 /// device, free the tables) so their DMA is blocked again and a restarted driver
 /// re-claims cleanly. Runs BEFORE the broker claims and the DMA frames are released.
+/// Re-point a device's existing confinement at a new owner, keeping its domain and
+/// its attachment intact.
+///
+/// Delegation needs this: the device manager claims a device (which confines it, with
+/// the manager as owner) and then transfers it to the driver. Without moving the
+/// confinement record too, the domain stays the manager's — so the driver's DMA
+/// buffers are never bound into it, its rings are invisible to the device, and every
+/// transfer faults. Worse, a manager death would then tear down a domain a live driver
+/// is using, and a driver death would leave one behind.
+///
+/// The domain is *not* rebuilt: the device stays attached throughout, so there is no
+/// window in which it is translating through nothing.
+pub fn reassign(device_id: u64, owner: u32) void {
+    if (!active) return;
+    if (device_id >= confined.len) return;
+    const record = &confined[@intCast(device_id)];
+    if (!record.active) return;
+    record.owner = owner;
+}
+
 pub fn releaseAllOwnedBy(owner: u32) void {
     if (!active) return;
     for (&confined) |*c| {