feat(kernel): shared ABI decoder+proofs, no-panic gate, syscall storm, kani on shrunk kernel

crates/kernel/src/syscall/mod.rs

@@ -12,6 +12,7 @@ use types::{bounded::CapSlot, id::ThreadId, syscall_abi::ErrorCode};
 use crate::Kernel;
 
 pub use ipc::{IpcState, ThreadRef};
+pub use types::syscall_abi::{Delivery, DeliveryKind};
 
 pub enum SyscallOutcome {
     Complete(SyscallResult),
@@ -21,38 +22,6 @@ pub enum SyscallOutcome {
     TerminateCaller,
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum DeliveryKind {
-    /// A `Send`; no reply expected.
-    Message,
-    /// A `Call`; the receiver's reply slot now names the caller.
-    Call,
-    /// Notification bits.
-    Signal,
-}
-
-/// What a receiving syscall hands back (docs/ipc.md, register ABI).
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct Delivery {
-    pub kind: DeliveryKind,
-    /// The sender's badge, or the signal bits.
-    pub badge: usize,
-    pub words: [usize; 4],
-    /// Where a transferred capability landed in the receiver's table.
-    pub cap: Option<CapSlot>,
-}
-
-impl Delivery {
-    pub fn signal(bits: usize) -> Self {
-        Self {
-            kind: DeliveryKind::Signal,
-            badge: bits,
-            words: [0; 4],
-            cap: None,
-        }
-    }
-}
-
 #[derive(Debug)]
 pub enum SyscallResult {
     Ok,