it's always nice to see new work in the OS space, especially capability-based on!
One thing in documentation that caught my eye:
> All capabilities can be destroyed but the last reference to a capability which is in-use cannot always be destroyed; for example one must unmap all pages in an address space before destroying the last reference to a VSpace capability.
All errors at the "closing" stage seem weird to me, but this one is strangest - AFAIK no other reference-count has DecRef/Release method that can fail because object is still in use. What usually happens is that the specific reference is destroyed, but the object itself (which no longer can be accessed in any way) hangs around until it's ready to be destroyed as well.
