feat(kernel): WatchDeath + SetTimer events as notification signals; adapter wakes at earliest deadline

docs/ipc.md

@@ -185,7 +185,26 @@ pass to that parent, so their budgets return there in turn.
 
 Destroying an endpoint or notification wakes every thread blocked on it with
 `InvalidCap`. Destroying a thread removes it from every queue, binding and
-reply slot; a dying process loses every IRQ route it set.
+reply slot; a dying process loses every IRQ route it set and its timer.
+
+## Events
+
+Two things the kernel notices itself, and reports by signalling a
+notification (with that notification capability's badge, or bit 0 if it
+has none). Both need `Write` on the notification, the right to signal it.
+
+- `WatchDeath(process, notification)`: needs `Execute` on the process
+  capability. The notification is signalled when that process dies, whether
+  by `Exit`, a fault or `Kill`. One watcher per process; a new one replaces
+  the old. Badge the notification per child to tell children apart.
+- `SetTimer(notification, deadline)`: signals once `GetTime` reaches
+  `deadline` (absolute, in `GetTime` ticks). One timer per process; setting
+  it again replaces it, a zero deadline cancels it, a past one fires at once.
+  The adapter programs the hardware for the earliest deadline, so a timer
+  fires on time rather than on the next scheduling tick.
+
+A target whose notification has since been destroyed is never signalled,
+even if its id was reused.
 
 ## Register ABI (RISC-V)