establishment: usb-transfer stops being a name

P1 of docs/establishment-planes-plan.md. The bus no longer binds
/protocol/usb-transfer — the bind race made whichever instance came second
unreachable, which on a real three-controller Ryzen meant a mouse no class
driver could reach ("could not open device 50"). Each instance hands its
serving endpoint up in the hello that already delegates its controller, and
class drivers receive their OWN controller's channel from helloForChannel —
routed by the manager's lineage, retried while a provider is mid-restart,
on one manager handle so retries never spend handle-table slots.

usb.open(bus, id) now takes the channel it used to look up; the name rows
leave protocol.csv with the code (bind 67, opens 119/120/122); the
conformance fixture's prose stops claiming the bus binds; and the stale
input-client import leaves the bus with the channel one.

Gate: 19 QEMU cases green (usb family, hubs, both IOMMU variants, fat chain,
boot-from-USB, orderly shutdown, conformance).

library/device/usb/usb.zig

@@ -5,12 +5,16 @@
 //! service and `device.zig` over the raw device calls.
 //!
 //! A class driver, spawned with its interface's assigned device id as argv[1]:
-//!     if (device_manager.hello(.device, id) == null) return; // meet the spawn deadline
-//!     var device = usb.open(id) orelse return;        // open + get its endpoints
+//!     const bus = device_manager.helloForChannel(.device, id) orelse return;
+//!     var device = usb.open(bus, id) orelse return;   // open + get its endpoints
 //!     _ = device.controlOut(usb_abi.setProtocol(...));// class requests, descriptors
 //!     _ = device.subscribeInterrupt(address, length); // reports arrive asynchronously
 //!     while (true) { ... ipc.replyWait(device.endpoint, ...) ... }  // its own loop
 //!
+//! The bus channel arrives from the device manager's hello — routed to THIS
+//! device's controller by lineage — never from a registry name; several bus
+//! processes provide this contract on a multi-controller machine.
+//!
 //! Reports are delivered to `device.endpoint` as asynchronous `interrupt_report`
 //! event packets, decoded with `reportOf` (the class driver runs a bare `replyWait`
 //! loop to read them, because the service harness drops buffered-message payloads
@@ -21,10 +25,8 @@
 //! a control transfer's data stage in the tail.
 
 const std = @import("std");
-const channel = @import("channel");
 const envelope = @import("envelope");
 const ipc = @import("ipc");
-const time = @import("time");
 const usb_transfer_protocol = @import("usb-transfer-protocol");
 
 const Protocol = usb_transfer_protocol.Protocol;
@@ -157,18 +159,14 @@ pub fn reportOf(packet: []const u8) ?InterruptReport {
     return Protocol.decodeEvent(.interrupt_report, packet);
 }
 
-/// Open `/protocol/usb-transfer` and, on that channel, open the device with the
-/// assigned id, handing over a freshly created endpoint for asynchronous interrupt
-/// reports. Retries while the bus is still coming up (a class driver races the bus
-/// driver at boot). Two opens, deliberately: the first names the contract, the
-/// second names an object within it.
-pub fn open(device_id: u64) ?Device {
-    var attempts: usize = 0;
-    const bus = while (attempts < 100) : (attempts += 1) {
-        if (channel.openEndpoint("usb-transfer")) |handle| break handle;
-        time.sleepMillis(20);
-    } else return null;
-
+/// On `bus` — the channel to this device's own controller, handed to the class
+/// driver by the device manager's hello (establishment by lineage,
+/// communication.md "Establishment: two planes") — open the device with the
+/// assigned id, handing over a freshly created endpoint for asynchronous
+/// interrupt reports. The channel is never found by name: one machine carries
+/// several controllers, several processes provide this contract, and only the
+/// manager knows which one reported this device.
+pub fn open(bus: ipc.Handle, device_id: u64) ?Device {
     const endpoint = ipc.createIpcEndpoint() orelse return null;
     // The assigned device id is the target: it is what the caller has before a
     // token exists, and the token the reply hands back addresses every packet