This closes the loop on xbusy protecting page identity. It makes lockless lookup much cleaner because I don't have to worry about code saying if (busy) unbusy(). Because busy does not have a strong ownership concept you can unlock another threads lock. As you can see very few changes were required to make the busy state consistent at this point.
I personally think the vm_page_replace() API is cleaner now. It is effectively always _checked(). We don't strictly need a pindex argument although in some cases it does provide for an additional assert.
It is not absolutely necessary that I assert the state but I prefer the stronger guarantee this gives. In the future it may provide an avenue to resolve the NOFREE flag on vm objects.