kernel: a refusal names its rule, and two bounds stop failing open

An AMD Ryzen booted to a working compositor with no USB and no storage,
and the log said only "register refused". A tree-wide audit of every
compile-time ceiling followed: 235 of them, 139 on quantities the machine
or a file decides rather than us, 5 documented anywhere, 171 silent when
reached. docs/fixed-bounds-audit.md has the inventory.

Errno attribution. The errno space was split between the kernel and the
envelope, free to drift; it is now one list in system/abi.zig, restated on
both sides, with a comptime check in library/device/driver where the two
halves are visible. device_register's six refusals and device_claim's three
are distinct codes, so a bus driver can say which rule stopped it, and
BadParent splits into NoSuchParent and NotYourParent. pci-bus reconciles
found against registered instead of counting refused functions as found.

Idempotency ordering. The child cap was checked before the identity match,
so a restarted bus was refused its own devices — the supervision restart the
system leans on ratcheted toward a degraded machine. A re-registration
consumes no slot and is now admitted first.

IOMMU fail-closed. confineDevice returned success for a device id past the
confinement table, leaving the device outside every domain while the caller
believed it confined — unreachable only while ids stop at 64, which both the
inventory move and a hardware-reported domain count would change. It refuses
now, and the coupling to the broker's device cap is a comptime assert rather
than a sentence in a comment.

PCI apertures. The bridge's MMIO apertures are derived from the holes in the
firmware memory map, and the derivation copied sub-4 GiB entries into a
fixed [64] array and skipped the rest. A skipped region is not merely lost:
the gap finder concludes it is free, so a real machine's 60-200 entry map
yields an aperture over live RAM, and containment then admits a child BAR
covering kernel memory. Rewritten to walk the map in place, with the hole
finder extracted as a pure function and driven by a synthetic 100-entry map
in a new test case. Both new tests were verified to fail on the old code.

parameters.zig gains the rationale it was missing and loses a stale sentence
pointing at the wrong file; vdso.md documents the errno space, including
EPEER, which had no written meaning anywhere.

docs/os-development/bounds.md is how a ceiling is declared from here.
docs/bounds-track-plan.md is the plan to remove the ones we invented.

Suite 114 -> 115.

system/kernel/ipc-synchronous.zig

@@ -42,15 +42,22 @@ pub const MESSAGE_MAXIMUM: usize = 256;
 pub const maximum_handles = scheduler.ipc_maximum_handles;
 
 /// Errno-style failures, returned as `-value` in the system_call result register.
-pub const EBADF: i64 = 1; // bad handle
-pub const E2BIG: i64 = 2; // message exceeds MESSAGE_MAXIMUM
-pub const EFAULT: i64 = 3; // buffer unmapped / out of the user half
-pub const ENOENT: i64 = 4; // no such name
-pub const ENOSPC: i64 = 5; // handle table full
-pub const ENOMEM: i64 = 6; // out of memory
-pub const EPEER: i64 = 7; // peer died before replying (its process exited or was killed)
-pub const ESRCH: i64 = 8; // no such process (process_kill of an unknown/dead id)
-pub const EPERM: i64 = 9; // not permitted (process_kill by anyone but the supervisor)
+/// Restated from the shared kernel↔user ABI (system/abi.zig), because ring 3 reads
+/// the same numbers — the same reason `notify_badge_bit` below is restated. New
+/// codes are added *there*, which is where the space is documented.
+pub const EBADF = abi.EBADF; // bad handle
+pub const E2BIG = abi.E2BIG; // message exceeds MESSAGE_MAXIMUM
+pub const EFAULT = abi.EFAULT; // buffer unmapped / out of the user half
+pub const ENOENT = abi.ENOENT; // no such name
+pub const ENOSPC = abi.ENOSPC; // a kernel table is full
+pub const ENOMEM = abi.ENOMEM; // out of memory
+pub const EPEER = abi.EPEER; // peer died before replying (its process exited or was killed)
+pub const ESRCH = abi.ESRCH; // no such process (process_kill of an unknown/dead id)
+pub const EPERM = abi.EPERM; // not permitted (process_kill by anyone but the supervisor)
+pub const ENODEV = abi.ENODEV; // no such device id
+pub const ECHILDREN = abi.ECHILDREN; // this parent is at its child cap
+pub const ERANGE = abi.ERANGE; // a resource escapes its parent's window
+pub const ECONFINE = abi.ECONFINE; // the device could not be placed under IOMMU translation
 
 /// A badge with this bit set is an asynchronous notification (e.g. an IRQ), not a
 /// message from a client — there is no reply owed. The low bits carry the source