core/memory.rad core/state.rad core/pages.rad core/atomic.rad core/cpu.rad \

	core/budgets.rad core/contexts.rad core/clock.rad core/budget_caps.rad

CORE_ASM := arch/atomic.ras arch/context.ras arch/clock.ras

	check/domains.rad check/capabilities.rad check/pages.rad check/events.rad \

	check/budgets.rad check/budget_caps.rad

record the contracts established through step 12 of the 22-step plan.

## Finite budgets and context identities

- Time is monotonic CLINT ticks at the FDT timebase frequency. A Budget retains

  a hardware hart, remaining ticks, and at most one bound context. Only boot

  provisions quantities; splitting and charging cannot increase their sum.

- Split requires Write, an unbound source, and available handle/object slots.

  It retains source rights and hart; a bound source returns Busy. A scheduler's

  unbound reserve must be distinct from its running budget.

- Bind requires Execute on both Budget and Domain, an Active domain, and a

  quiescent context. First binding fixes the context's hart. A binding retains

  its Budget object even when all handles to that object disappear.

- Context identities pack a nonzero u32 incarnation above a u32 table index.

  There are at most 512 contexts. Zero is invalid and exhausted incarnations

  never wrap. Possession of an identity alone grants no authority.

- Start creates a linear Running obligation and checked deadline; program the

  timer before U-mode entry. Architectural return consumes the obligation and

  charges the monotonic interval once, including transition overhead, saturating

  at zero. Empty, wrong-hart, incorrectly bound, or non-ready contexts cannot run.

- Creating a context or publishing an event supplies no ticks. Checks exercise

  conservation, failed operations, retained bindings, and actual CLINT preemption.

Exercise budget conservation and failed split/bind operations; preempt finite computation through CLINT and reject execution after exhaustion.

// Validated RV64 CLINT windows use native, naturally aligned 64-bit accesses.

.text;

.export @"core::clock::read";

@"core::clock::read"

	li     %t0    0xbff8;

	add    %a0    %a0    %t0;

	ld     %a0    0(%a0);

	ret;

.export @"core::clock::arm";

@"core::clock::arm"

	slli   %a1    %a1    3;

	add    %a0    %a0    %a1;

	li     %t0    0x4000;

	add    %a0    %a0    %t0;

	fence;

	sd     %a2    0(%a0);

	ret;

.export @"core::clock::interrupts";

@"core::clock::interrupts"

	csrw   mie    %a0;

	ret;

mod budgets;

mod budget_caps;

    budgets::run();

    budget_caps::run();

//! Budget authority conservation across binding, handle drop, and resource reuse.

use core::abi;

use core::budget_caps;

use core::budgets;

use core::capabilities;

use core::contexts;

use core::domains;

use core::frames;

use core::handles;

use core::memory;

use core::platform;

use core::resources;

use core::state;

/// Two independent protection domains for authority checks.

static DOMAINS: [domains::Domain; 2] = undefined;

/// Exactly enough resource slots for a reserve, a loan, and its replacement.

static OBJECTS: [resources::Slot; 3] = undefined;

/// One context that retains execution authority independently of handles.

static CONTEXTS: [contexts::Context; 1] = undefined;

/// Valid empty physical-memory accounting for this capability-only fixture.

static POOL: frames::Pool = undefined;

/// Empty-pool pin storage.

static PINS: [u16; 1] = undefined;

/// Empty-pool object claims.

static ASSIGNED: [bool; 1] = undefined;

/// Empty-pool persistent domain grants.

static GRANTS: [u64; 2] = undefined;

/// Shared kernel mechanism storage.

static KERNEL: state::State = undefined;

/// Reject a split without consuming any authority from the source.

fn reject(source: abi::Handle, expected: abi::Error) {

    let _handle = try budget_caps::split(&mut KERNEL, 0, source, 1) catch error {

        assert error == expected;

        return;

    };

    panic "reject: invalid budget split succeeded";

}

/// Reject binding authority to a context owned by a different target domain.

fn wrongTarget(source: abi::Handle, target: abi::Handle, context: u64) {

    try budget_caps::bind(&mut KERNEL, 0, source, target, context) catch error {

        assert error == abi::Error::Denied;

        return;

    };

    panic "wrongTarget: another domain context accepted authority";

}

/// Preserve charged execution after handles vanish and reclaim only after unbinding.

export fn run() {

    domains::init(&mut DOMAINS[..]);

    contexts::init(&mut CONTEXTS[0], 0);

    resources::init(&mut OBJECTS[..]);

    let mut machine: platform::Platform = undefined;

    set machine.memoryCount = 0;

    set machine.reservedCount = 0;

    try! frames::init(&mut POOL, &machine);

    let mut ram: memory::Memory = undefined;

    memory::init(&mut ram, &mut POOL, &mut PINS[..], &mut ASSIGNED[..], &mut GRANTS[..], 2);

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], contexts: &mut CONTEXTS[..], memory: ram };

    let rootHandle = domains::root(&mut DOMAINS[..], 0);

    let root = try! domains::resolve(&DOMAINS[..], 0, rootHandle, abi::CREATE);

    let child = try! domains::create(&mut DOMAINS[..], root, 0);

    let target = handles::install(&mut DOMAINS[0].handles, 2, child, abi::DOMAIN_RIGHTS);

    set DOMAINS[0].state = domains::Lifecycle::Active;

    set DOMAINS[child.index].state = domains::Lifecycle::Active;

    try! contexts::prepare(&mut CONTEXTS[0], child, 0, 0, DOMAINS[child.index].env);

    let id = contexts::identity(&CONTEXTS[0]);

    let reserve = try! resources::create(&mut OBJECTS[..], resources::Value::Budget(try! budgets::init(0, 1000)));

    resources::retain(&mut OBJECTS[..], reserve);

    let source = handles::install(&mut DOMAINS[0].handles, 3, reserve, abi::READ | abi::WRITE | abi::EXECUTE | abi::GRANT | abi::TRANSFER);

    let loan = try! budget_caps::split(&mut KERNEL, 0, source, 400);

    wrongTarget(loan, rootHandle, id);

    try! budget_caps::bind(&mut KERNEL, 0, loan, target, id);

    reject(loan, abi::Error::Busy);

    let received = try! capabilities::grant(&mut KERNEL, 0, loan, target, abi::EXECUTE as u64);

    try! capabilities::drop(&mut KERNEL, 0, loan);

    try! capabilities::drop(&mut KERNEL, child.index, received);

    let retained = budget_caps::value(&mut KERNEL, CONTEXTS[0].budget);

    let running = try! contexts::begin(&mut CONTEXTS[0], retained, 1, 0);

    assert contexts::finish(&mut CONTEXTS[0], retained, running, 101) == 300;

    let replacement = try! budget_caps::split(&mut KERNEL, 0, source, 100);

    reject(source, abi::Error::Exhausted);

    assert budget_caps::value(&mut KERNEL, reserve).remaining == 500;

    try! budget_caps::bind(&mut KERNEL, 0, replacement, target, id);

    let _reused = try! budget_caps::split(&mut KERNEL, 0, source, 1);

    assert budget_caps::value(&mut KERNEL, reserve).remaining == 499;

}

//! Conservation, execution binding, exhaustion, and non-wrapping deadline checks.

use core::abi;

use core::budgets;

use core::platform;

/// Observe provisioning failures without accepting an unexpected success.

fn initError(hart: u32, ticks: u64) -> abi::Error {

    let _budget = try budgets::init(hart, ticks) catch error { return error; };

    return abi::Error::Ok;

}

/// Observe split failures while retaining the source for subsequent execution.

fn splitError(source: *mut budgets::Budget, ticks: u64) -> abi::Error {

    let _budget = try budgets::split(source, ticks) catch error { return error; };

    return abi::Error::Ok;

}

/// Observe binding failures while retaining the previous execution authority.

fn bindError(budget: *mut budgets::Budget, context: u64, hart: u32) -> abi::Error {

    try budgets::bind(budget, context, hart) catch error { return error; };

    return abi::Error::Ok;

}

/// Observe deadline failures without modifying the budget.

fn deadlineError(budget: *budgets::Budget, now: u64) -> abi::Error {

    let _deadline = try budgets::deadline(budget, now) catch error { return error; };

    return abi::Error::Ok;

}

/// Check that splitting, failed mutation, and context reuse cannot mint ticks.

export fn run() {

    let first: u64 = 0x100000007;

    let next: u64 = 0x200000007;

    assert initError(platform::MAX_HARTS, 1) == abi::Error::InvalidArg;

    assert initError(0, 0) == abi::Error::InvalidArg;

    let mut source = try! budgets::init(0, 1000);

    let mut child = try! budgets::split(&mut source, 400);

    assert splitError(&mut source, 0) == abi::Error::InvalidArg;

    assert splitError(&mut source, 601) == abi::Error::Exhausted;

    assert bindError(&mut source, 0, 0) == abi::Error::InvalidArg;

    assert bindError(&mut source, first, platform::MAX_HARTS) == abi::Error::InvalidArg;

    assert bindError(&mut source, first, 1) == abi::Error::Denied;

    assert bindError(&mut child, next, 1) == abi::Error::Denied;

    try! budgets::bind(&mut source, first, 0);

    try! budgets::bind(&mut child, next, 0);

    assert try! budgets::deadline(&source, 100) == 700;

    assert try! budgets::deadline(&child, 100) == 500;

    assert splitError(&mut source, 1) == abi::Error::Busy;

    assert bindError(&mut source, first, 0) == abi::Error::Busy;

    assert bindError(&mut source, next, 0) == abi::Error::Busy;

    assert bindError(&mut source, next, 1) == abi::Error::Denied;

    assert budgets::charge(&mut source, first, 150) == 450;

    budgets::unbind(&mut source, first);

    try! budgets::bind(&mut source, next, 0);

    assert budgets::charge(&mut source, next, 200) == 250;

    assert budgets::charge(&mut child, next, 399) == 1;

    assert source.remaining + child.remaining + 150 + 200 + 399 == 1000;

    assert budgets::charge(&mut source, next, 0) == 250;

    assert budgets::charge(&mut source, next, 250) == 0;

    assert deadlineError(&source, 0) == abi::Error::Exhausted;

    assert budgets::charge(&mut source, next, 1) == 0;

    budgets::unbind(&mut source, next);

    assert bindError(&mut source, first, 0) == abi::Error::Exhausted;

    assert splitError(&mut source, 1) == abi::Error::Exhausted;

    assert budgets::charge(&mut child, next, 0xffffffffffffffff) == 0;

    budgets::unbind(&mut child, next);

    assert bindError(&mut child, first, 0) == abi::Error::Exhausted;

    // Moving the complete balance leaves execution authority only in the child.

    let mut reserve = try! budgets::init(1, 50);

    let mut entire = try! budgets::split(&mut reserve, 50);

    assert bindError(&mut reserve, first, 1) == abi::Error::Exhausted;

    assert bindError(&mut entire, first, 0) == abi::Error::Denied;

    try! budgets::bind(&mut entire, first, 1);

    assert budgets::charge(&mut entire, first, 50) == 0;

    budgets::unbind(&mut entire, first);

    // Exact maximum deadlines are valid; an overflow failure cannot consume ticks.

    let mut limit = try! budgets::init(0, 0xffffffffffffffff);

    assert try! budgets::deadline(&limit, 0) == 0xffffffffffffffff;

    assert deadlineError(&limit, 1) == abi::Error::InvalidArg;

    try! budgets::bind(&mut limit, first, 0);

    assert budgets::charge(&mut limit, first, 1) == 0xfffffffffffffffe;

    assert try! budgets::deadline(&limit, 1) == 0xffffffffffffffff;

    assert deadlineError(&limit, 2) == abi::Error::InvalidArg;

    assert budgets::charge(&mut limit, first, 0xfffffffffffffffe) == 0;

    budgets::unbind(&mut limit, first);

}

use core::contexts;

/// Context storage for the shared kernel state.

static CONTEXTS: [contexts::Context; 1] = undefined;

    contexts::init(&mut CONTEXTS[0], 0);

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], contexts: &mut CONTEXTS[..], memory: ram };

.export @"context::loopEntry";

@"context::loopEntry"

	la     %a0    @loop;

	ret;

@loop

	addi   %a0    %a0    1;

	j      @loop;

use core::contexts;

/// Context storage for the shared kernel state.

static CONTEXTS: [contexts::Context; 1] = undefined;

    contexts::init(&mut CONTEXTS[0], 0);

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], contexts: &mut CONTEXTS[..], memory: ram };

use core::budgets;

use core::clock;

use core::contexts;

/// Address of a user computation that can stop only through preemption.

fn loopEntry() -> u64;

/// Refuse user entry when the retained authority has no ticks left.

fn exhausted(context: *mut contexts::Context, budget: *mut budgets::Budget, now: u64) {

    let running = try contexts::begin(context, budget, now, 0) catch error {

        assert error == abi::Error::Exhausted;

        return;

    };

    let _remaining = contexts::finish(context, budget, running, now);

    panic "exhausted: execution began without budget";

}

    let mut context: contexts::Context = undefined;

    contexts::init(&mut context, 0);

    try! contexts::prepare(&mut context, abi::Object { kind: abi::Kind::Domain, index: 0, epoch: 1 }, loopEntry(), 0, context.env);

    set context.frame.registers[10] = 0;

    let mut budget = try! budgets::init(0, 1000);

    try! budgets::bind(&mut budget, contexts::identity(&context), 0);

    set context.hart = 0;

    let running = try! contexts::begin(&mut context, &budget, clock::read(0x02000000), 0);

    clock::arm(0x02000000, 0, context.deadline);

    clock::interrupts(128);

    cpu::enter(&mut context.frame);

    let stopped = clock::read(0x02000000);

    clock::interrupts(0);

    clock::arm(0x02000000, 0, 0xffffffffffffffff);

    assert contexts::finish(&mut context, &mut budget, running, stopped) == 0;

    assert context.frame.cause == 0x8000000000000007;

    assert context.frame.registers[10] > 0 and context.frame.registers[10] <= 500;

    exhausted(&mut context, &mut budget, stopped);

export mod budgets;

export mod contexts;

export mod clock;

export mod budget_caps;

//! Capability-mediated budget splitting and exclusive context binding.

use core::abi;

use core::budgets;

use core::capabilities;

use core::contexts;

use core::domains;

use core::handles;

use core::resources;

use core::state;

/// Borrow the accounting value of a retained, live Budget resource.

export fn value(kernel: *mut state::State, object: abi::Object) -> *mut budgets::Budget {

    assert object.kind == abi::Kind::Budget;

    let slot = &mut kernel.resources[object.index];

    assert slot.epoch == object.epoch and slot.references > 0;

    match &mut slot.value {

        case resources::Value::Budget(budget) => return budget,

        else => panic "value: budget identity does not name accounting state",

    }

}

/// Move a finite quantity into a fresh handle after all slot-capacity checks.

export fn split(kernel: *mut state::State, caller: u32, source: abi::Handle, ticks: u64) -> abi::Handle throws (abi::Error) {

    let entry = try capabilities::lookup(kernel, caller, source);

    if entry.object.kind <> abi::Kind::Budget { throw abi::Error::BadHandle; }

    if entry.rights & abi::WRITE == 0 { throw abi::Error::Denied; }

    let handleSlot = try handles::vacant(&kernel.domains[caller].handles);

    let objectSlot = try resources::vacant(kernel.resources);

    let child = try budgets::split(value(kernel, entry.object), ticks);

    let object = resources::install(kernel.resources, objectSlot, resources::Value::Budget(child));

    resources::retain(kernel.resources, object);

    return handles::install(&mut kernel.domains[caller].handles, handleSlot, object, entry.rights);

}

/// Bind execution authority to an authorized, quiescent context on the same hart.

/// A binding retains the Budget even if its last user handle is dropped.

export fn bind(kernel: *mut state::State, caller: u32, source: abi::Handle, target: abi::Handle, id: u64) throws (abi::Error) {

    let entry = try capabilities::lookup(kernel, caller, source);

    if entry.object.kind <> abi::Kind::Budget { throw abi::Error::BadHandle; }

    if entry.rights & abi::EXECUTE == 0 { throw abi::Error::Denied; }

    let domain = try domains::resolve(kernel.domains, caller, target, abi::EXECUTE);

    let index = try contexts::resolve(kernel.contexts, id);

    let context = &mut kernel.contexts[index];

    if context.owner.index <> domain.index or context.owner.epoch <> domain.epoch {

        throw abi::Error::Denied;

    }

    if kernel.domains[domain.index].state <> domains::Lifecycle::Active {

        throw abi::Error::InvalidArg;

    }

    if context.status == contexts::Status::Running { throw abi::Error::Busy; }

    let budget = value(kernel, entry.object);

    if context.hart <> contexts::NO_HART and context.hart <> budget.hart { throw abi::Error::Denied; }

    try budgets::bind(budget, id, budget.hart);

    if context.budget.kind == abi::Kind::Budget {

        budgets::unbind(value(kernel, context.budget), id);

        let _released = resources::release(kernel.resources, context.budget);

    }

    resources::retain(kernel.resources, entry.object);

    set context.budget = entry.object;

    set context.hart = budget.hart;

}

/// Release a quiescent context's retained binding after its last interval is charged.

export fn unbind(kernel: *mut state::State, context: *mut contexts::Context) {

    assert context.status <> contexts::Status::Running;

    if context.budget.kind == abi::Kind::Budget {

        budgets::unbind(value(kernel, context.budget), contexts::identity(context));

        let _released = resources::release(kernel.resources, context.budget);

        set context.budget = domains::none();

    }

}

//! Finite, hart-local execution authority measured in monotonic CLINT ticks.

use core::abi;

use core::platform;

/// Kernel-owned accounting value; copies must not create independent authority.

/// Callers serialize access and validate live, generation-qualified identities.

export record Budget: Copy {

    /// Hardware hart on which this authority can execute.

    hart: u32,

    /// Unconsumed CLINT ticks; only splitting and charging can reduce them.

    remaining: u64,

    /// Bound context incarnation, or zero while available for binding or split.

    context: u64,

}

/// Create boot-provisioned authority; reject unsupported harts and zero ticks.

/// The caller also verifies that the hart is present in the boot topology.

export fn init(hart: u32, ticks: u64) -> Budget throws (abi::Error) {

    if hart >= platform::MAX_HARTS or ticks == 0 { throw abi::Error::InvalidArg; }

    return Budget { hart, remaining: ticks, context: 0 };

}

/// Move ticks into an unbound child on the same hart without replenishment.

/// Busy forbids changing in-flight accounting; every failure preserves source.

export fn split(source: *mut Budget, ticks: u64) -> Budget throws (abi::Error) {

    if source.context <> 0 { throw abi::Error::Busy; }

    if ticks == 0 { throw abi::Error::InvalidArg; }

    if ticks > source.remaining { throw abi::Error::Exhausted; }

    set source.remaining -= ticks;

    return Budget { hart: source.hart, remaining: ticks, context: 0 };

}

/// Bind one nonzero context incarnation to nonempty authority on its own hart.

/// InvalidArg rejects malformed input, Denied a different hart, Busy an existing

/// binding, and Exhausted an empty balance. Failures preserve execution authority.

export fn bind(budget: *mut Budget, context: u64, hart: u32) throws (abi::Error) {

    if context == 0 or hart >= platform::MAX_HARTS { throw abi::Error::InvalidArg; }

    if hart <> budget.hart { throw abi::Error::Denied; }

    if budget.context <> 0 { throw abi::Error::Busy; }

    if budget.remaining == 0 { throw abi::Error::Exhausted; }

    set budget.context = context;

}

/// Release the exact bound incarnation without restoring any consumed ticks.

/// Matching a nonzero identity is a kernel invariant, not user input validation.

export fn unbind(budget: *mut Budget, context: u64) {

    assert context <> 0 and budget.context == context;

    set budget.context = 0;

}

/// Debit elapsed monotonic CLINT ticks and return the remaining balance.

/// The caller charges each execution interval once, before releasing its binding.

/// A matching nonzero identity is required even after saturation at zero.

export fn charge(budget: *mut Budget, context: u64, elapsed: u64) -> u64 {

    assert context <> 0 and budget.context == context;

    if elapsed >= budget.remaining {

        set budget.remaining = 0;

    } else {

        set budget.remaining -= elapsed;

    }

    return budget.remaining;

}

/// Compute a timer deadline, including before binding, without changing authority.

/// Exhausted rejects zero balance; InvalidArg rejects overflow instead of wrapping.

export fn deadline(budget: *Budget, now: u64) -> u64 throws (abi::Error) {

    if budget.remaining == 0 { throw abi::Error::Exhausted; }

    if now > 0xffffffffffffffff - budget.remaining { throw abi::Error::InvalidArg; }

    return now + budget.remaining;

}

//! Machine-only CLINT access using validated physical platform addresses.

/// Read monotonic ticks from a validated CLINT register window.

export unsafe fn read(clint: u64) -> u64;

/// Program one validated CLINT bank's timer compare, with ordered MMIO access.

export unsafe fn arm(clint: u64, bank: u32, deadline: u64);

/// Select enabled machine interrupt sources while global M-mode interrupts are off.

export unsafe fn interrupts(mask: u64);

//! Bounded execution identities and linear obligations for charged user intervals.

use core::abi;

use core::budgets;

use core::cpu;

use core::domains;

use core::frames;

use core::platform;

/// Maximum execution contexts shared by all domains.

export constant CAPACITY: u32 = 512;

/// Hart value before an execution context has been bound.

export constant NO_HART: u32 = 0xffffffff;

/// Execution state independent of the owning domain's lifecycle.

export union Status: Copy {

    /// Slot available for a new incarnation.

    Vacant,

    /// Can be dispatched when its bound budget permits execution.

    Ready,

    /// One hart owns a live accounting interval and architectural frame.

    Running,

    /// Waiting for an unread domain event.

    Waiting,

    /// Explicitly stopped; dispatch requires a new request.

    Stopped,

}

/// Private state for one execution context; all mutation is kernel serialized.

export record Context: Copy {

    /// Complete architectural user state.

    frame: cpu::Frame,

    /// Immutable environment addressed by this context's tp.

    env: domains::Env,

    /// Owning protection-domain incarnation.

    owner: abi::Object,

    /// Resource identity retained by this context's budget binding.

    budget: abi::Object,

    /// Private stack allocation; count zero means not provisioned.

    private: frames::Run,

    /// Stable table index.

    index: u32,

    /// Nonzero live incarnation; exhausted slots are not reused.

    epoch: u32,

    /// Execution transition state.

    status: Status,

    /// Bound hardware hart, or NO_HART before binding.

    hart: u32,

    /// Explicit caller to resume when this context relinquishes execution.

    continuation: u64,

    /// Deadline of the current charged interval.

    deadline: u64,

}

/// A started interval that must be charged exactly once after architectural return.

export union Running: Once {

    /// Context identity and monotonic start time of the interval.

    Interval { identity: u64, started: u64 },

}

/// Initialize one table slot before it can receive a context incarnation.

export fn init(context: *mut Context, index: u32) {

    assert index < CAPACITY;

    set context.index = index;

    set context.epoch = 0;

    set context.status = Status::Vacant;

    set context.owner = domains::none();

    set context.budget = domains::none();

    set context.private = frames::Run { first: 0, count: 0 };

    set context.hart = NO_HART;

    set context.continuation = 0;

    set context.deadline = 0;

    set context.env = domains::Env {

        argsPointer: 0, argsSize: 0, eventsHandle: 0, eventsPointer: 0,

        stateBase: 0, stackBase: 0, stackTop: 0, context: 0,

        privateStackBase: 0, privateStackTop: 0,

    };

    cpu::init(&mut context.frame, 0, 0, 0, 0);

}

/// Get the nonzero incarnation-qualified identity of an initialized context.

export fn identity(context: *Context) -> u64 {

    if context.epoch == 0 { return 0; }

    return (context.epoch as u64 << 32) | context.index as u64;

}

/// Resolve a current context incarnation without treating an integer as authority.

export fn resolve(table: *[Context], id: u64) -> u32 throws (abi::Error) {

    let index = id as u32;

    let epoch = id >> 32;

    if epoch == 0 or index >= table.len { throw abi::Error::InvalidArg; }

    let context = &table[index];

    if context.epoch as u64 <> epoch or context.status == Status::Vacant {

        throw abi::Error::InvalidArg;

    }

    return index;

}

/// Install checked image and startup state in a vacant slot, without granting budget.

export fn prepare(context: *mut Context, owner: abi::Object, entry: u64, stack: u64, env: domains::Env) throws (abi::Error) {

    if context.status <> Status::Vacant { throw abi::Error::Busy; }

    if context.epoch == 0xffffffff { throw abi::Error::Exhausted; }

    assert owner.kind == abi::Kind::Domain and owner.epoch <> 0;

    set context.epoch += 1;

    set context.owner = owner;

    set context.budget = domains::none();

    set context.hart = NO_HART;

    set context.continuation = 0;

    set context.deadline = 0;

    set context.env = env;

    set context.env.context = identity(context);

    cpu::init(&mut context.frame, entry, stack, &context.env as u64, env.stateBase);

    set context.status = Status::Ready;

}

/// Start authorized execution after the caller has checked the owning domain is active.

/// The caller programs deadline before user entry and owns the frame until finish.

export fn begin(context: *mut Context, budget: *budgets::Budget, now: u64, hart: u32) -> Running throws (abi::Error) {

    if context.status <> Status::Ready { throw abi::Error::Busy; }

    if hart >= platform::MAX_HARTS or context.hart <> hart or budget.hart <> hart {

        throw abi::Error::Denied;

    }

    let id = identity(context);

    if id == 0 or budget.context <> id { throw abi::Error::Denied; }

    let deadline = try budgets::deadline(budget, now);

    set context.deadline = deadline;

    set context.status = Status::Running;

    return Running::Interval { identity: id, started: now };

}

/// Charge one completed interval before any binding, wait, or lifecycle mutation.

export fn finish(context: *mut Context, budget: *mut budgets::Budget, running: Running, now: u64) -> u64 {

    match running {

        case Running::Interval { identity: id, started } => {

            assert context.status == Status::Running and identity(context) == id;

            assert now >= started;

            let remaining = budgets::charge(budget, id, now - started);

            set context.status = Status::Ready;

            return remaining;

        },

    }

}