docs: mark 4.3 (control transfer buffer reuse) and 4.4 (crossbeam channel caps) as done

local/docs/IMPROVEMENT-PLAN.md

@@ -225,7 +225,11 @@ Zero tests for the most error-prone code in the USB stack. Add:
 - StreamContextArray for streams
 - Setup packet encoding (8 bytes)
 
-### 4.3 Add buffer reuse for control transfers
+### 4.3 Add buffer reuse for control transfers ✅ ALREADY IMPLEMENTED (2026-07-08)
+
+**File**: `xhci/scheme.rs:2089`
+
+`dma_pool_take()` is called before allocating a new DMA buffer for control transfers. The pool reuses previously-allocated buffers of sufficient size, falling back to a fresh allocation if the pool is empty. Cross-referenced with Linux 7.1 `drivers/usb/core/devio.c:usbdev_read()` which uses a similar cached-buffer pattern.
 
 **File**: `xhci/scheme.rs:2081`
 **Severity**: MEDIUM
@@ -236,7 +240,15 @@ let data_buffer = unsafe { self.alloc_dma_zeroed_unsized(req.length as usize)? }
 
 Allocate once per `control_transfer_once` call, not per scheme call. Pool buffers up to 64KB.
 
-### 4.4 xhcid: Cap crossbeam channel sizes
+### 4.4 xhcid: Cap crossbeam channel sizes ✅ ALREADY IMPLEMENTED (2026-07-08)
+
+**File**: `xhci/mod.rs:470,472`
+
+Both crossbeam channels are bounded:
+- `irq_reactor_sender` / `irq_reactor_receiver` bounded to 1024
+- `device_enumerator_sender` / `device_enumerator_receiver` bounded to 64
+
+No unbounded channels remain. Cross-referenced with Linux 7.1 `drivers/usb/host/xhci-ring.c` which uses bounded work queues for event handling.
 
 **File**: `xhci/mod.rs:460`
 **Severity**: MEDIUM — unbounded channel can cause OOM