feat(kernel): ipc cap transfer drops Delegate; one owner per irq line, freed when owner dies

docs/ipc.md

@@ -100,7 +100,9 @@ the UART) to their drivers before anything else (`libkos::device`):
 A message is 4 words and at most one capability. The capability is
 transferred only if the sender's endpoint capability has `Delegate` and the
 transferred capability itself has `Delegate`; it is **copied** (the sender
-keeps its own) with its permissions and badge unchanged. If the receiver's
+keeps its own) with the same badge and permissions minus `Delegate`: the
+receiver can use it but not pass it on. To let a process pass a capability
+on, give it with the `Delegate` syscall and explicit rights. If the receiver's
 table is full, or the capability is no longer valid at delivery time, the
 message is delivered without it.
 
@@ -128,8 +130,10 @@ never reveals the sender's process or thread id.
 - `BindNotification(ntfn)`: bind to the calling thread. One binding per
   thread and per notification.
 - `SetIrqNotification(irq, ntfn)`: deliver interrupt `irq` as `Signal`
-  through the given (badged) notification capability.
-- `AckInterrupt(irq)`: unmask the line after handling.
+  through the given (badged) notification capability. The first process to
+  route a line owns it; other holders of the IRQ capability get
+  `IrqAlreadyOwned` until the owner dies or its notification is destroyed.
+- `AckInterrupt(irq)`: unmask the line after handling (owner only).
 
 An interrupt masks its line and signals its notification. If no route is
 set it stays masked.
@@ -148,8 +152,8 @@ set it stays masked.
 ## Death
 
 Destroying an endpoint or notification wakes every thread blocked on it with
-`InvalidCap`. Destroying a thread removes it from every queue, binding,
-reply slot and IRQ route.
+`InvalidCap`. Destroying a thread removes it from every queue, binding and
+reply slot; a dying process loses every IRQ route it set.
 
 ## Register ABI (RISC-V)