record the contracts established through step 20 of the 22-step plan.

## Complete direct-call dispatch

- core::calls validates arguments and authority and returns explicit effects for

  architectural integration. Ordinary failures and invalid metadata queries

  return Error. QueryContext requires an explicit Domain handle with Execute,

  not merely the self-sentinel.

- Calls 70 through 76 are BudgetSplit, BudgetBind, ContextCreate, ContextRun,

  QueryBudget, QueryContext, and Delegate. Splits conserve ticks and hart identity;

  a context binding retains its budget after the handle is dropped.

- Hosted dispatcher checks cover ordinary errors, metadata values, query errors,

  authority attenuation, and returned execution/lifecycle effects. Machine

  scheduling of these effects is separate from their validation.

- Public Page counts, Interrupt numbers, and Events capacities use u32. Public

  domain identifiers use u16, with Pending, Active, and Dead lifecycle values.

  The register transport uses u64 words.

Run hosted direct-call coverage for argument and authority errors, metadata, query errors, and execution/lifecycle effects. Keep the existing native, context, IRQ, activation, and lifecycle checks.

mod calls;

    calls::run();

//! Dispatcher boundary regressions using real capability and accounting mechanisms.

use core::abi;

use core::budget_caps;

use core::budgets;

use core::calls;

use core::capabilities;

use core::contexts;

use core::domains;

use core::fdt;

use core::frames;

use core::handles;

use core::lifecycle;

use core::memory;

use core::platform;

use core::resources;

use core::state;

static DOMAINS: [domains::Domain; 2] = undefined;

static OBJECTS: [resources::Slot; 2] = undefined;

static CONTEXTS: [contexts::Context; 1] = undefined;

static POOL: frames::Pool = undefined;

static PINS: [u16; 1] = undefined;

static ASSIGNED: [bool; 1] = undefined;

static GRANTS: [u64; 2] = undefined;

static KERNEL: state::State = undefined;

/// Exercise a returning operation through exactly the public seven-word input.

fn reply(caller: u32, number: u64, args: [u64; 7], now: u64) -> [u64; 4] {

    let result = try! calls::dispatch(&mut KERNEL, caller, number, &args[..], now);

    match result {

        case calls::Outcome::Reply { values } => return values,

        else => panic "reply: expected completed direct call",

    }

}

/// Observe a boundary rejection without substituting a lower-level helper.

fn reject(caller: u32, number: u64, args: [u64; 7], expected: abi::Error) {

    let _result = try calls::dispatch(&mut KERNEL, caller, number, &args[..], 100) catch error {

        assert error == expected;

        return;

    };

    panic "reject: invalid direct call succeeded";

}

/// Slot kinds, reserved bits, and MMIO widths/rights remain full-width inputs.

fn materialization(root: abi::Handle) {

    let device = try! resources::create(&mut OBJECTS[..], resources::Value::Device(fdt::Range { base: 0x1000, size: 8 }));

    resources::retain(&mut OBJECTS[..], device);

    let handle = handles::install(&mut DOMAINS[0].handles, 3, device, abi::READ);

    let readonly = reply(0, 10, [handle.bits, 0, 0, 0, 0, 0, 0], 0)[0];

    let info = reply(0, 45, [readonly, 0, 0, 0, 0, 0, 0], 0);

    assert info[0] == 0x1000 and info[1] == 8;

    reject(0, 61, [readonly, 0, 1, 1, 0, 0, 0], abi::Error::Denied);

    assert reply(0, 62, [3, 3, 0, 0, 0, 0, 0], 0)[0] == handle.bits;

    reject(0, 62, [3, 0x100000003, 0, 0, 0, 0, 0], abi::Error::BadHandle);

    reject(0, 62, [0x100000003, 3, 0, 0, 0, 0, 0], abi::Error::BadHandle);

    reject(0, 62, [3, 1, 0, 0, 0, 0, 0], abi::Error::BadHandle);

    reject(0, 45, [handle.bits | 0x1000000, 0, 0, 0, 0, 0, 0], abi::Error::BadHandle);

    reject(0, 61, [handle.bits, 0, 0x100000001, 1, 0, 0, 0], abi::Error::InvalidArg);

    reject(0, 61, [handle.bits, 0, 1, 0x10001, 0, 0, 0], abi::Error::InvalidArg);

    reject(0, 60, [root.bits, 0x10001, 0, 0, 0, 0, 0], abi::Error::InvalidArg);

    assert reply(0, 61, [handle.bits, 0, 8, 1, 0, 0, 0], 0)[0] == 0x1000;

    let _drop = reply(0, 12, [handle.bits, 0, 0, 0, 0, 0, 0], 0);

    let replacement = handles::install(&mut DOMAINS[0].handles, 3, device, abi::READ);

    resources::retain(&mut OBJECTS[..], device);

    reject(0, 45, [handle.bits, 0, 0, 0, 0, 0, 0], abi::Error::BadHandle);

    assert reply(0, 62, [3, 3, 0, 0, 0, 0, 0], 0)[0] == replacement.bits;

    // A valid slot generation is insufficient when its resource incarnation dies.

    set OBJECTS[device.index].epoch += 1;

    reject(0, 62, [3, 3, 0, 0, 0, 0, 0], abi::Error::BadHandle);

    set OBJECTS[device.index].epoch = device.epoch;

}

/// Running metadata is conservatively debited; Run keeps admission transactional.

fn execution(target: abi::Handle, child: abi::Object) {

    set DOMAINS[child.index].state = domains::Lifecycle::Active;

    try! contexts::prepare(&mut CONTEXTS[0], child, 0, 0, DOMAINS[child.index].env);

    let id = contexts::identity(&CONTEXTS[0]);

    set DOMAINS[child.index].env.context = id;

    let resource = try! resources::create(&mut OBJECTS[..], resources::Value::Budget(try! budgets::init(0, 1000)));

    resources::retain(&mut OBJECTS[..], resource);

    let handleSlot = try! handles::vacant(&DOMAINS[0].handles);

    let handle = handles::install(&mut DOMAINS[0].handles, handleSlot, resource, abi::EXECUTE);

    let _bound = reply(0, 71, [handle.bits, target.bits, id, 0, 0, 0, 0], 0);

    let budget = budget_caps::value(&mut KERNEL, resource);

    let running = try! contexts::begin(&mut CONTEXTS[0], budget, 100, 0);

    let query = reply(0, 74, [handle.bits, 0, 0, 0, 0, 0, 0], 300);

    assert query[1] == 800 and query[2] == id;

    let current = reply(0, 75, [target.bits, 0, 0, 0, 0, 0, 0], 300);

    assert current[0] == id and current[2] == contexts::Status::Running as u64 and current[3] == 800;

    assert reply(0, 74, [handle.bits, 0, 0, 0, 0, 0, 0], 1200)[1] == 0;

    reject(0, 73, [target.bits, id, 0, 0, 0, 0, 0], abi::Error::Busy);

    assert contexts::finish(&mut CONTEXTS[0], budget, running, 350) == 750;

    assert reply(0, 74, [handle.bits, 0, 0, 0, 0, 0, 0], 1000)[1] == 750;

    let _drop = reply(0, 12, [handle.bits, 0, 0, 0, 0, 0, 0], 1000);

    set CONTEXTS[0].status = contexts::Status::Stopped;

    let args = [target.bits, id, 0, 0, 0, 0, 0];

    match try! calls::dispatch(&mut KERNEL, 0, 73, &args[..], 1000) {

        case calls::Outcome::Run { context } => { assert context == id; },

        else => panic "execution: retained binding could not run",

    }

    assert CONTEXTS[0].status == contexts::Status::Stopped;

    set CONTEXTS[0].status = contexts::Status::Waiting;

    reject(0, 73, args, abi::Error::Busy);

    set CONTEXTS[0].status = contexts::Status::Stopped;

    reject(0, 75, [target.bits, id + (1 as u64 << 32), 0, 0, 0, 0, 0], abi::Error::InvalidArg);

}

/// Independent target-local administrative authority survives source death.

export fn run() {

    domains::init(&mut DOMAINS[..]);

    contexts::init(&mut CONTEXTS[0], 0);

    resources::init(&mut OBJECTS[..]);

    let mut machine: platform::Platform = undefined;

    set machine.memoryCount = 0;

    set machine.reservedCount = 0;

    try! frames::init(&mut POOL, &machine);

    let mut ram: memory::Memory = undefined;

    memory::init(&mut ram, &mut POOL, &mut PINS[..], &mut ASSIGNED[..], &mut GRANTS[..], 2);

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], contexts: &mut CONTEXTS[..], memory: ram };

    let rootHandle = domains::root(&mut DOMAINS[..], 0);

    let root = try! domains::resolve(&DOMAINS[..], 0, rootHandle, abi::CREATE);

    let child = try! domains::create(&mut DOMAINS[..], root, 0);

    let target = handles::install(&mut DOMAINS[0].handles, 2, child, abi::DOMAIN_RIGHTS);

    materialization(rootHandle);

    execution(target, child);

    reject(0, 76, [rootHandle.bits, target.bits, 0x100000020, 0, 0, 0, 0], abi::Error::InvalidArg);

    reject(0, 76, [rootHandle.bits, target.bits, abi::DESTROY as u64, 0, 0, 0, 0], abi::Error::InvalidArg);

    let createGrant = (abi::CREATE | abi::GRANT) as u64;

    let narrow = reply(0, 10, [rootHandle.bits, 0, createGrant, 0, 0, 0, 0], 0)[0];

    reject(0, 76, [narrow, target.bits, abi::ALLOCATE as u64, 0, 0, 0, 0], abi::Error::Denied);

    reject(0, 76, [target.bits, target.bits, abi::CREATE as u64, 0, 0, 0, 0], abi::Error::Denied);

    let delegated = reply(0, 76, [narrow, target.bits, createGrant, 0, 0, 0, 0], 0)[0];

    let local = abi::Handle { bits: delegated };

    let authority = try! capabilities::lookup(&KERNEL, child.index, local);

    assert authority.object.index == child.index and authority.object.epoch == child.epoch;

    assert authority.rights as u64 == createGrant;

    lifecycle::terminate(&mut KERNEL, root, 4, 0);

    assert lifecycle::poll(&mut KERNEL) == nil;

    assert DOMAINS[0].state == domains::Lifecycle::Dead;

    let survivor = try! domains::authority(&DOMAINS[..], child.index, local, abi::CREATE);

    assert survivor.index == child.index and survivor.epoch == child.epoch;

    let info = reply(child.index, 47, [local.bits, 0, 0, 0, 0, 0, 0], 0);

    assert info[0] == child.index as u64 and info[1] == root.index as u64;

    assert info[2] == abi::INVALID_DOMAIN as u64;

}

export mod calls;

//! Serialized direct-call control plane; architectural handoff belongs to runtime.

use core::abi;

use core::activation;

use core::budget_caps;

use core::budgets;

use core::capabilities;

use core::contexts;

use core::devices;

use core::domains;

use core::events;

use core::frames;

use core::handles;

use core::lifecycle;

use core::notifications;

use core::pages;

use core::physical;

use core::platform;

use core::resources;

use core::state;

/// A completed reply or an obligation the runtime must complete before replying.

/// Control outcomes never authorize touching another hart's architectural frame.

export union Outcome: Copy {

    /// Successful value words for a1..a4; runtime writes Error::Ok to a0.

    Reply { values: [u64; 4] },

    /// Relinquish execution through the current continuation/scheduler protocol.

    Yield,

    /// Validate Events progress and wait for an event with retained budget.

    Wait,

    /// Arm the current hart's bounded timer table before returning success.

    /// ticks is a monotonic delay; token is returned in the Timeout event.

    Timeout { ticks: u64, token: u32 },

    /// Record terminal cause and drive quiescence; never return to this domain.

    /// kind is Fault=3 or ChildExit=4; code is the first terminal status.

    Terminate { kind: u16, code: u32 },

    /// Snapshot the selected incarnations, then call lifecycle::request and wait

    /// for their reclamation. This raw request has not yet been validated.

    /// handle selects a Domain; flags bit zero includes creation descendants.

    Destroy { handle: abi::Handle, flags: u64 },

    /// Validated execution request. Runtime must admit the target hart before

    /// resuming a Stopped context or installing any continuation/handoff state.

    /// context is the incarnation-qualified execution identity.

    Run { context: u64 },

}

/// Resolve metadata authority without imposing extra Read rights.

fn object(kernel: *state::State, caller: u32, handle: abi::Handle, kind: abi::Kind) -> abi::Object throws (abi::Error) {

    let entry = try capabilities::lookup(kernel, caller, handle);

    if entry.object.kind <> kind { throw abi::Error::BadHandle; }

    return entry.object;

}

/// Match a context incarnation to an explicitly authorized domain identity.

/// Only QueryContext permits zero to select the domain's initial environment.

fn context(kernel: *state::State, owner: abi::Object, id: u64) -> u32 throws (abi::Error) {

    let index = try contexts::resolve(kernel.contexts, id);

    let actual = kernel.contexts[index].owner;

    if actual.kind <> abi::Kind::Domain or actual.index <> owner.index or actual.epoch <> owner.epoch {

        throw abi::Error::Denied;

    }

    return index;

}

/// Read accounting without touching frames or charging another hart's interval.

/// The deadline bounds a Running context's balance at the supplied monotonic now.

fn remaining(kernel: *state::State, identity: abi::Object, budget: *budgets::Budget, now: u64) -> u64 throws (abi::Error) {

    if budget.context == 0 { return budget.remaining; }

    let index = try contexts::resolve(kernel.contexts, budget.context);

    let bound = &kernel.contexts[index];

    if bound.budget.kind <> abi::Kind::Budget or bound.budget.index <> identity.index

        or bound.budget.epoch <> identity.epoch or bound.hart <> budget.hart {

        throw abi::Error::BadHandle;

    }

    if bound.status <> contexts::Status::Running { return budget.remaining; }

    if now >= bound.deadline { return 0; }

    let ticks = bound.deadline - now;

    if ticks < budget.remaining { return ticks; }

    return budget.remaining;

}

/// Read a retained binding, returning zero for a context without budget.

fn contextRemaining(kernel: *state::State, index: u32, now: u64) -> u64 throws (abi::Error) {

    let bound = &kernel.contexts[index];

    if bound.budget.kind == abi::Kind::Empty { return 0; }

    if bound.budget.kind <> abi::Kind::Budget

        or not resources::live(kernel.resources, kernel.domains, bound.budget) {

        throw abi::Error::BadHandle;

    }

    let case resources::Value::Budget(budget) = &kernel.resources[bound.budget.index].value else {

        panic "contextRemaining: budget kind mismatch";

    };

    if budget.context <> contexts::identity(bound) { throw abi::Error::BadHandle; }

    return try remaining(kernel, bound.budget, &budget, now);

}

/// Preflight execution without changing context status or remote admission state.

fn runnable(kernel: *state::State, caller: u32, target: abi::Handle, id: u64) throws (abi::Error) {

    let owner = try domains::resolve(kernel.domains, caller, target, abi::EXECUTE);

    let index = try context(kernel, owner, id);

    if kernel.domains[owner.index].state <> domains::Lifecycle::Active { throw abi::Error::InvalidArg; }

    let bound = &kernel.contexts[index];

    if bound.status <> contexts::Status::Ready and bound.status <> contexts::Status::Stopped {

        throw abi::Error::Busy;

    }

    if bound.budget.kind <> abi::Kind::Budget

        or not resources::live(kernel.resources, kernel.domains, bound.budget) {

        throw abi::Error::Denied;

    }

    let slot = &kernel.resources[bound.budget.index];

    let case resources::Value::Budget(budget) = &slot.value else { panic "runnable: budget kind mismatch"; };

    if slot.references == 0 or budget.context <> id or bound.hart <> budget.hart

        or bound.hart >= platform::MAX_HARTS { throw abi::Error::Denied; }

    if budget.remaining == 0 { throw abi::Error::Exhausted; }

}

/// Install independent administrative authority on target's own incarnation.

/// Only existing Create/Allocate/Grant/Transfer rights can be delegated; Grant

/// on source is mandatory. All checks, including destination capacity, precede

/// installation. No existing handle or source-domain lifetime is carried over.

fn delegate(kernel: *mut state::State, caller: u32, source: abi::Handle, target: abi::Handle, rights: u64) -> abi::Handle throws (abi::Error) {

    let allowed = (abi::CREATE | abi::ALLOCATE | abi::GRANT | abi::TRANSFER) as u64;

    if rights & ~allowed <> 0 or rights & (abi::CREATE | abi::ALLOCATE) as u64 == 0 {

        throw abi::Error::InvalidArg;

    }

    let entry = try capabilities::lookup(kernel, caller, source);

    if entry.object.kind <> abi::Kind::Domain { throw abi::Error::BadHandle; }

    if entry.rights & abi::GRANT == 0 or entry.rights as u64 & rights <> rights {

        throw abi::Error::Denied;

    }

    let owner = try domains::resolve(kernel.domains, caller, target, 0);

    let slot = try handles::vacant(&kernel.domains[owner.index].handles);

    return handles::install(&mut kernel.domains[owner.index].handles, slot, owner, rights as u16);

}

/// Materialize an existing live slot only after checking full-width index/kind.

fn slot(kernel: *state::State, caller: u32, index: u64, kind: u64) -> abi::Handle throws (abi::Error) {

    if index >= abi::MAX_HANDLES as u64 { throw abi::Error::BadHandle; }

    let mut wanted = abi::Kind::Empty;

    match kind {

        case 1 => set wanted = abi::Kind::Page,

        case 2 => set wanted = abi::Kind::Interrupt,

        case 3 => set wanted = abi::Kind::Device,

        case 4 => set wanted = abi::Kind::Events,

        case 5 => set wanted = abi::Kind::Domain,

        case 6 => set wanted = abi::Kind::Budget,

        else => throw abi::Error::BadHandle,

    }

    let handle = try handles::get(&kernel.domains[caller].handles, index as u32, wanted);

    if not resources::live(kernel.resources, kernel.domains, kernel.domains[caller].handles.entries[index as u32].object) {

        throw abi::Error::BadHandle;

    }

    return handle;

}

/// Reject high bits before narrowing loader-requested Page or Device rights.

fn accessRights(bits: u64) -> u16 throws (abi::Error) {

    if bits == 0 or bits & ~((abi::READ | abi::WRITE) as u64) <> 0 {

        throw abi::Error::InvalidArg;

    }

    return bits as u16;

}

/// Dispatch a7 using the seven a0..a6 input words while holding the global lock.

/// caller is a live domain index; arguments has at least seven words. now is a

/// monotonic CLINT timestamp used only to conservatively query running budgets.

/// Returning effects finish here. Runtime completes control obligations before

/// replying, advances returning ecalls, and faults query/slot errors (44..48,

/// 62, 74, 75) and undefined calls rather than exposing their error return.

/// Calls 60/61/62 support trusted runtime wrappers: Page bounds, one transient

/// Device access, and a typed existing-slot lookup. RIL verification is deferred.

export fn dispatch(kernel: *mut state::State, caller: u32, number: u64, arguments: *[u64], now: u64) -> Outcome throws (abi::Error) {

    assert caller < kernel.domains.len and arguments.len >= 7;

    let first = abi::Handle { bits: arguments[0] };

    let second = abi::Handle { bits: arguments[1] };

    let mut values: [u64; 4] = [0; 4];

    match number {

        case 10 => set values[0] = (try capabilities::grant(kernel, caller, first, second, arguments[2])).bits,

        case 11 => set values[0] = (try capabilities::transfer(kernel, caller, first, second, arguments[2])).bits,

        case 12 => try capabilities::drop(kernel, caller, first),

        case 20 => set values[0] = (try activation::create(kernel, caller, first, arguments[1], physical::clear, physical::copy)).bits,

        case 21 => {

            let _initial = try activation::activate(kernel, caller, first, arguments[1], arguments[2], arguments[3], physical::clear);

        },

        case 22 => return Outcome::Destroy { handle: first, flags: arguments[1] },

        case 23 => try lifecycle::reparent(kernel, caller, first, second),

        case 30 => set values[0] = (try pages::allocate(kernel, caller, first, arguments[1], physical::clear)).bits,

        case 31 => set values[0] = (try pages::split(kernel, caller, first, arguments[1])).bits,

        case 40 => return Outcome::Yield,

        case 41 => {

            if arguments[1] > 0xffffffff { throw abi::Error::InvalidArg; }

            return Outcome::Timeout { ticks: arguments[0], token: arguments[1] as u32 };

        },

        case 42 => return Outcome::Wait,

        case 43 => return Outcome::Terminate { kind: 3, code: 0x100 },

        case 44 => {

            let range = try pages::access(kernel, caller, first, 0);

            set values[0] = range.base;

            set values[1] = range.size / frames::PAGE_SIZE as u64;

        },

        case 45 => {

            let identity = try object(kernel, caller, first, abi::Kind::Device);

            let case resources::Value::Device(region) = kernel.resources[identity.index].value else { panic "dispatch: device kind mismatch"; };

            set values[0] = region.base;

            set values[1] = region.size;

        },

        case 46 => {

            let identity = try object(kernel, caller, first, abi::Kind::Interrupt);

            let case resources::Value::Interrupt(irq) = kernel.resources[identity.index].value else { panic "dispatch: interrupt kind mismatch"; };

            set values[0] = irq.number as u64;

        },

        case 47 => {

            let identity = try object(kernel, caller, first, abi::Kind::Domain);

            let domain = &kernel.domains[identity.index];

            set values[0] = identity.index as u64;

            set values[1] = domain.creator.index as u64;

            set values[2] = abi::INVALID_DOMAIN as u64;

            if domains::live(kernel.domains, domain.parent) { set values[2] = domain.parent.index as u64; }

            set values[3] = domain.state as u64;

        },

        case 48 => {

            let _identity = try object(kernel, caller, first, abi::Kind::Events);

            set values[0] = events::CAPACITY as u64;

        },

        case 49 => {

            if arguments[0] > 0xffffffff { throw abi::Error::InvalidArg; }

            return Outcome::Terminate { kind: 4, code: arguments[0] as u32 };

        },

        case 50 => {

            if arguments[1] > 0xffffffff { throw abi::Error::InvalidArg; }

            try notifications::wakeup(kernel, caller, first, arguments[1] as u32);

        },

        case 60 => {

            let rights = try accessRights(arguments[1]);

            let range = try pages::access(kernel, caller, first, rights);

            set values[0] = range.base;

            set values[1] = range.size;

        },

        case 61 => {

            let rights = try accessRights(arguments[3]);

            set values[0] = try devices::access(kernel, caller, first, arguments[1], arguments[2], rights);

        },

        case 62 => set values[0] = (try slot(kernel, caller, arguments[0], arguments[1])).bits,

        case 70 => set values[0] = (try budget_caps::split(kernel, caller, first, arguments[1])).bits,

        case 71 => try budget_caps::bind(kernel, caller, first, second, arguments[2]),

        case 72 => set values[0] = try activation::context(kernel, caller, first, arguments[1], arguments[2], arguments[3], physical::clear),

        case 73 => {

            try runnable(kernel, caller, first, arguments[1]);

            return Outcome::Run { context: arguments[1] };

        },

        case 74 => {

            let identity = try object(kernel, caller, first, abi::Kind::Budget);

            let case resources::Value::Budget(budget) = &kernel.resources[identity.index].value else { panic "dispatch: budget kind mismatch"; };

            set values[0] = budget.hart as u64;

            set values[1] = try remaining(kernel, identity, &budget, now);

            set values[2] = budget.context;

        },

        case 75 => {

            let owner = try domains::resolve(kernel.domains, caller, first, abi::EXECUTE);

            let mut id = arguments[1];

            if id == 0 { set id = kernel.domains[owner.index].env.context; }

            let index = try context(kernel, owner, id);

            set values[0] = id;

            set values[1] = kernel.contexts[index].hart as u64;

            set values[2] = kernel.contexts[index].status as u64;

            set values[3] = try contextRemaining(kernel, index, now);

        },

        case 76 => set values[0] = (try delegate(kernel, caller, first, second, arguments[2])).bits,

        else => throw abi::Error::InvalidArg,

    }

    return Outcome::Reply { values };

}

use core::calls;

        match try! calls::dispatch(&mut KERNEL, 0, args[17], &args[10..17], 0) {

            case calls::Outcome::Reply { values } => {

                cpu::reply(&mut frame, abi::Error::Ok, values[0], values[1], values[2], values[3]);

            case calls::Outcome::Terminate { kind, code } => {

                assert kind == 4 and code == expected;

            else => panic "native: unexpected control effect",

    if image == 0 {

        assert *(physical::bytes(dataBase, 8).ptr as *u64) == 42;

        assert *(physical::bytes(descriptor.initial, 8).ptr as *u64) == 0;

    }

    assert hart == 0;

}

//! Shared assertions and explicit capability setup for the control workloads.

/// Abort unless the two values are equal.

export fn equal(actual: u64, expected: u64) { if actual <> expected { sys::abort(); } }

/// Abort if the value is zero.

export fn positive(value: u64) { if value == 0 { sys::abort(); } }

/// Allocate the requested contiguous frames or fail the workload.

export fn allocate(authority: abi::Handle, count: u64) -> abi::Handle {

    return try! sys::pageAllocate(authority, count);

}

/// Create a domain and verify its pending lifecycle.

export fn create(authority: abi::Handle, image: u64) -> abi::Handle {

    let child = try! sys::domainCreate(authority, image);

    assert sys::queryDomain(child).state == sys::DomainLifecycle::Pending;

    return child;

}

/// Read a domain's public identifier.

export fn id(domain: abi::Handle) -> u16 { return sys::queryDomain(domain).id; }

/// Install attenuated authority in the target domain.

export fn grant(source: abi::Handle, target: abi::Handle, rights: u64) -> abi::Handle {

    return try! sys::capabilityGrant(source, target, rights);

}

/// Grant a writable stack and readable arguments before context creation.

fn stack(authority: abi::Handle, target: abi::Handle, args: abi::Handle) -> u64 {

    let page = allocate(authority, 2);

    let _stack = grant(page, target, 3);

    let _args = grant(args, target, 1);

    let top = sys::queryPage(page).base + 8192;

    try! sys::capabilityDrop(page);

    return top;

}

/// Activate the first context and verify that it has no CPU budget.

export fn activate(authority: abi::Handle, target: abi::Handle, args: abi::Handle, size: u32) -> u64 {

    let top = stack(authority, target, args);

    try! sys::domainActivate(target, top, try! sys::pageSlice(args, 0, size));

    let info = sys::queryContext(target, 0);

    positive(info.id);

    equal(info.hart, 0xffffffff);

    equal(info.status, 1);

    equal(info.remaining, 0);

    return info.id;

}

/// Create another context with its own authorized stack.

export fn context(authority: abi::Handle, target: abi::Handle, args: abi::Handle, size: u32) -> u64 {

    let top = stack(authority, target, args);

    let context = try! sys::contextCreate(target, top, try! sys::pageSlice(args, 0, size));

    positive(context);

    return context;

}

/// Bind a new budget and verify conservation and hart assignment.

export fn fund(reserve: abi::Handle, target: abi::Handle, context: u64, ticks: u64) -> abi::Handle {

    let before = sys::queryBudget(reserve);

    equal(before.context, 0);

    let budget = try! sys::budgetSplit(reserve, ticks);

    equal(before.remaining - sys::queryBudget(reserve).remaining, ticks);

    let split = sys::queryBudget(budget);

    equal(split.hart, before.hart);

    equal(split.remaining, ticks);

    equal(split.context, 0);

    try! sys::budgetBind(budget, target, context);

    equal(sys::queryBudget(budget).context, context);

    equal(sys::queryContext(target, context).hart, before.hart);

    return budget;

}

/// Admit an explicitly authorized context for execution.

export fn run(target: abi::Handle, context: u64) { try! sys::contextRun(target, context); }

/// Verify the state of an incarnation-qualified context.

export fn status(target: abi::Handle, context: u64, expected: u64) {

    let info = sys::queryContext(target, context);

    equal(info.id, context);

    equal(info.status, expected);

}

/// Wait for and consume exactly the expected next notification.

export fn event(env: *sys::Env, kind: u16, code: u32, value: u64) {

    loop {

        if let event = sys::eventsPop(env) {

            equal(event.kind as u64, kind as u64);

            equal(event.code as u64, code as u64);

            equal(event.value, value);

            return;

        }

        try! sys::wait();

    }

}

/// Fail if an unexpected notification is pending.

export fn empty(env: *sys::Env) {

    if let _event = sys::eventsPop(env) { sys::abort(); }

}

/// Verify that insufficient Allocate authority is denied.

export fn allocationDenied(authority: abi::Handle) {

    let _page = try sys::pageAllocate(authority, 1) catch error {

        assert error == abi::Error::Denied;

        return;

    };

    sys::abort();

}