library: five protocols speak the envelope

The folded header stops being a rule in a document and becomes the layout
on the wire. Verbs number from sixteen, leaving describe, enumerate,
subscribe and unsubscribe reserved and answered the same way by every
provider — none of them writes a line to do it. What each protocol used to
carry in a field of its own now travels in the header: a vfs node and a
display layer are the packet's target, and a reply opens with a status the
envelope stamps rather than one each protocol spelled for itself.

Display gains the most. One forty-byte request had served eleven verbs, so
attach_scanout smuggled stride through x, refresh through y and format
through colour, and every coordinate crossed as a bitcast. Per-operation
structs end all three: the fields have their own names and their own signs,
and the tile payload grows to 224 bytes because the prefix shrank. Scanout
loses a message maximum of 64 it had no business declaring — it answers
calls, and the floor for a call is 256 — and virtio-gpu stops hard-coding
that number at its harness.

Two changes are semantic rather than notational. A directory now ends at an
entry with no name, because the fixed part of a reply always travels and a
zero-length reply no longer exists to mean anything. And input joins the
service harness, the last loop in the tree that answered no ping and heard
no terminate; its subscriber table, its pruning and its fan-out are the
same code, and a shutdown now asks it to stop instead of killing it.

A new conformance case reads the registry's own listing and asks every
protocol it finds for its name, its version and its verb count, then offers
a verb nobody defines and requires -ENOSYS — the envelope's promise,
checked against providers rather than against itself. What it cannot reach
in that boot it names on the serial line instead of passing quietly.

Suite 110/110.

system/services/display/backend.zig

@@ -13,6 +13,7 @@ const memory = @import("memory");
 const logging = @import("logging");
 const compositor = @import("compositor.zig");
 
+const envelope = @import("envelope");
 const scanout_protocol = @import("scanout-protocol");
 const Rect = compositor.Rect;
 const Surface = compositor.Surface;
@@ -188,45 +189,53 @@ pub const VirtioGpu = struct {
     /// accumulated; the driver transfers + fenced-flushes the whole frame.
     pub fn present(self: *const VirtioGpu, damage: []const Rect) void {
         _ = damage;
-        var request = scanout_protocol.Request{
-            .operation = @intFromEnum(scanout_protocol.Operation.present),
-            .width = self.width,
-            .height = self.height,
-        };
-        var reply: [scanout_protocol.reply_size]u8 = undefined;
-        _ = ipc.call(self.scanout, std.mem.asBytes(&request), &reply) catch {};
+        _ = call(self.scanout, .present, .{ .width = self.width, .height = self.height });
     }
     /// Fill `out` with the driver's offered modes; returns how many were written.
     pub fn modes(self: *const VirtioGpu, out: []Mode) usize {
-        var request = scanout_protocol.Request{ .operation = @intFromEnum(scanout_protocol.Operation.get_modes) };
-        var reply: [scanout_protocol.modes_reply_size]u8 = undefined;
-        const n = ipc.call(self.scanout, std.mem.asBytes(&request), &reply) catch return 0;
-        if (n < scanout_protocol.modes_reply_size) return 0;
-        const answer = std.mem.bytesToValue(scanout_protocol.ModesReply, reply[0..scanout_protocol.modes_reply_size]);
-        if (answer.status != 0) return 0;
-        const count = @min(@min(answer.count, scanout_protocol.max_modes), out.len);
-        for (0..count) |i| out[i] = answer.modes[i];
+        const answered = call(self.scanout, .get_modes, {}) orelse return 0;
+        const offered = Scanout.decodeReply(.get_modes, answered.packet[0..answered.len]) orelse return 0;
+        const count = @min(@min(offered.count, scanout_protocol.max_modes), out.len);
+        for (0..count) |i| out[i] = offered.modes[i];
         return count;
     }
     /// Change the scanout resolution. On success the active `width`/`height` update (the shared
     /// surface — sized to the max mode — is unchanged, so `stride` stays put).
     pub fn setMode(self: *VirtioGpu, w: u32, h: u32) bool {
         if (w == 0 or h == 0 or w > self.stride) return false;
-        var request = scanout_protocol.Request{
-            .operation = @intFromEnum(scanout_protocol.Operation.set_mode),
-            .width = w,
-            .height = h,
-        };
-        var reply: [scanout_protocol.reply_size]u8 = undefined;
-        const n = ipc.call(self.scanout, std.mem.asBytes(&request), &reply) catch return false;
-        if (n < scanout_protocol.reply_size) return false;
-        if (std.mem.bytesToValue(scanout_protocol.Reply, reply[0..scanout_protocol.reply_size]).status != 0) return false;
+        _ = call(self.scanout, .set_mode, .{ .width = w, .height = h }) orelse return false;
         self.width = w;
         self.height = h;
         return true;
     }
 };
 
+const Scanout = scanout_protocol.Protocol;
+
+/// A reply the driver answered with, kept whole so the caller can decode the
+/// verb's own fixed part out of it.
+const Answered = struct {
+    packet: [scanout_protocol.message_maximum]u8,
+    len: usize,
+};
+
+/// One request at the scanout driver. Null covers both a transport failure and a
+/// driver that refused — a present that did not happen is a present that did not
+/// happen, and this backend has nothing to do about either but skip the frame.
+fn call(
+    scanout: ipc.Handle,
+    comptime operation: Scanout.Operation,
+    request: Scanout.RequestOf(operation),
+) ?Answered {
+    var packet: [scanout_protocol.message_maximum]u8 = undefined;
+    const framed = Scanout.encodeRequest(operation, 0, request, &.{}, &packet) orelse return null;
+    var answered: Answered = .{ .packet = undefined, .len = 0 };
+    answered.len = ipc.call(scanout, framed, &answered.packet) catch return null;
+    const status = envelope.statusOf(answered.packet[0..answered.len]) orelse return null;
+    if (status.status != 0) return null;
+    return answered;
+}
+
 /// The pluggable scanout backend. A tagged union so the compositor holds one value and
 /// dispatches without caring which is active; the `virtio` native backend joins `gop` at V4.
 pub const Backend = union(enum) {