record the contracts established through step 19 of the 22-step plan.

## Termination and reclamation

- The first accepted Exit or Fault fixes the terminal report. Dying domains

  immediately lose lookup, activation, and dispatch authority. Retain physical

  state until every context has returned its architectural frame and completed

  budget accounting.

- Destruction may select creation descendants independently of notification

  parents. Reparent requires Destroy on the child and Wake on the new parent;

  reserve the new terminal credit before releasing the old one. Queued terminal

  reports keep their original receiver.

- Reclamation releases context bindings, private stacks, installed capabilities,

  and lifetime Page pins. Surviving recipients retain Page memory. Domain,

  Events, handle, and context incarnations prevent stale-name reuse.

- Root termination obeys the same lifecycle rules. Surviving children become

  parentless and retain independent authority. Domain exit is not machine

  shutdown.

- Checks cover running-context retention, cascades through dead creators,

  exhausted reparenting credits, stale names, and malformed parent progress.

  Destroying an image instance must preserve its sibling and immutable initializer

  so a newly created instance starts from the same value.

Exercise deferred resource retention, creation cascades, reparenting capacity, first terminal reports, surviving Page recipients, and stale identities. Destroy an instance, preserve its sibling, then create and execute a fresh instance from the unchanged initializer.

mod lifecycle;

    lifecycle::run();

//! Incarnation invalidation, creation ancestry, credits, and quiescent teardown.

use core::abi;

use core::budget_caps;

use core::budgets;

use core::capabilities;

use core::contexts;

use core::domains;

use core::events;

use core::fdt;

use core::frames;

use core::handles;

use core::lifecycle;

use core::memory;

use core::pages;

use core::platform;

use core::resources;

use core::state;

/// Simulated physical backing, never dereferenced as a host physical address.

static RAM: [u8; 64 * frames::PAGE_SIZE] = undefined;

/// Enough slots for a creator chain, survivors, and an unrelated replacement.

static DOMAINS: [domains::Domain; 8] = undefined;

/// Page and retained-budget identities.

static OBJECTS: [resources::Slot; 8] = undefined;

/// Both contexts must quiesce before either private stack is reclaimed.

static CONTEXTS: [contexts::Context; 2] = undefined;

/// Frame availability and lifetime accounting.

static POOL: frames::Pool = undefined;

static PINS: [u16; 64] = undefined;

static ASSIGNED: [bool; 64] = undefined;

static GRANTS: [u64; 8] = undefined;

/// Public mechanism state shared by each isolated scenario.

static KERNEL: state::State = undefined;

/// Clear only the allocator's simulated physical range.

fn clear(base: u64, size: u32) {

    assert base <= RAM.len as u64 and size as u64 <= RAM.len as u64 - base;

    for i in base as u32..base as u32 + size { set RAM[i] = 0; }

}

/// Reset boot-owned storage between behavior scenarios.

fn setup() -> abi::Object {

    let mut machine: platform::Platform = undefined;

    set machine.memoryCount = 1;

    set machine.memory[0] = fdt::Range { base: 0, size: RAM.len as u64 };

    set machine.reservedCount = 0;

    try! frames::init(&mut POOL, &machine);

    let mut ram: memory::Memory = undefined;

    memory::init(&mut ram, &mut POOL, &mut PINS[..], &mut ASSIGNED[..], &mut GRANTS[..], DOMAINS.len);

    domains::init(&mut DOMAINS[..]);

    resources::init(&mut OBJECTS[..]);

    for i in 0..CONTEXTS.len { contexts::init(&mut CONTEXTS[i], i); }

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], contexts: &mut CONTEXTS[..], memory: ram };

    let root = domains::root(&mut DOMAINS[..], 0);

    return try! domains::resolve(&DOMAINS[..], 0, root, abi::CREATE);

}

/// Install test-owned authority through the real handle generation mechanism.

fn handle(caller: u32, object: abi::Object, rights: u16) -> abi::Handle {

    resources::retain(&mut OBJECTS[..], object);

    return handles::install(&mut DOMAINS[caller].handles, try! handles::vacant(&DOMAINS[caller].handles), object, rights);

}

/// A healthy consumer permits one complete bounded reclamation pass.

fn poll() {

    if let bad = lifecycle::poll(&mut KERNEL) { panic "poll: unexpected invalid consumer"; }

}

/// Reject stale authority through consumer-visible lookup, not table inspection.

fn badHandle(caller: u32, name: abi::Handle) {

    let _entry = try capabilities::lookup(&KERNEL, caller, name) catch error {

        assert error == abi::Error::BadHandle;

        return;

    };

    panic "badHandle: stale capability regained authority";

}

/// Require rejected destroy requests to report an error rather than succeed idle.

fn badRequest(caller: u32, name: abi::Handle, flags: u64, expected: abi::Error) {

    let _owner = try lifecycle::request(&mut KERNEL, caller, name, flags) catch error {

        assert error == expected;

        return;

    };

    panic "badRequest: invalid destroy succeeded";

}

/// Old execution identities remain invalid after their slots are prepared again.

fn badContext(id: u64) {

    let _index = try contexts::resolve(&CONTEXTS[..], id) catch error {

        assert error == abi::Error::InvalidArg;

        return;

    };

    panic "badContext: stale context resolved";

}

/// Preserve physical ownership until all charged execution has returned.

fn quiescence() {

    let root = setup();

    let child = try! domains::create(&mut DOMAINS[..], root, 0);

    let target = handle(0, child, abi::DOMAIN_RIGHTS);

    let targetSlot = try! handles::slot(&DOMAINS[0].handles, target);

    let self = handle(child.index, child, abi::ROOT_RIGHTS);

    let parent = handle(child.index, root, abi::WAKE);

    let oldEvents = abi::Handle { bits: DOMAINS[child.index].env.eventsHandle };

    let eventsAlias = try! capabilities::grant(&mut KERNEL, child.index, oldEvents, abi::Handle { bits: 0 }, abi::READ as u64);

    let shared = try! pages::allocate(&mut KERNEL, child.index, self, 2, clear);

    let external = try! capabilities::grant(&mut KERNEL, child.index, shared, parent, abi::PAGE_RIGHTS as u64);

    let dropped = try! pages::allocate(&mut KERNEL, child.index, self, 1, clear);

    try! capabilities::drop(&mut KERNEL, child.index, dropped);

    let _exclusive = try! pages::allocate(&mut KERNEL, child.index, self, 1, clear);

    set DOMAINS[child.index].private = frames::install(try! frames::allocate(&mut POOL, 2, clear));

    set DOMAINS[child.index].state = domains::Lifecycle::Active;

    for i in 0..CONTEXTS.len {

        try! contexts::prepare(&mut CONTEXTS[i], child, 32, 4096, DOMAINS[child.index].env);

        set CONTEXTS[i].private = frames::install(try! frames::allocate(&mut POOL, 1, clear));

    }

    let id = contexts::identity(&CONTEXTS[0]);

    let second = contexts::identity(&CONTEXTS[1]);

    let budget = try! resources::create(&mut OBJECTS[..], resources::Value::Budget(try! budgets::init(0, 100)));

    let budgetHandle = handle(0, budget, abi::EXECUTE);

    try! budget_caps::bind(&mut KERNEL, 0, budgetHandle, target, id);

    try! capabilities::drop(&mut KERNEL, 0, budgetHandle);

    let running = try! contexts::begin(&mut CONTEXTS[0], budget_caps::value(&mut KERNEL, budget), 10, 0);

    let owner = try! lifecycle::request(&mut KERNEL, 0, target, 0);

    badHandle(0, target);

    badHandle(child.index, oldEvents);

    badHandle(child.index, eventsAlias);

    badRequest(0, target, 0, abi::Error::BadHandle);

    poll();

    assert not lifecycle::completed(&DOMAINS[..], owner);

    assert POOL.available == 56;

    assert try! contexts::resolve(&CONTEXTS[..], second) == 1;

    assert DOMAINS[0].events.ring.tail == 0;

    assert budget_caps::value(&mut KERNEL, budget).context == id;

    assert contexts::finish(&mut CONTEXTS[0], budget_caps::value(&mut KERNEL, budget), running, 15) == 95;

    poll();

    assert lifecycle::completed(&DOMAINS[..], owner);

    badContext(id);

    badContext(second);

    assert POOL.available == 62;

    assert resources::kind(OBJECTS[budget.index].value) == abi::Kind::Empty;

    assert (try! pages::access(&KERNEL, 0, external, abi::READ)).size == 2 * frames::PAGE_SIZE as u64;

    assert DOMAINS[0].events.ring.tail == 1;

    assert DOMAINS[0].events.ring.data[0].kind == 4 and DOMAINS[0].events.ring.data[0].value == child.index as u64;

    poll();

    assert DOMAINS[0].events.ring.tail == 1;

    let replacement = try! domains::create(&mut DOMAINS[..], root, 0);

    assert replacement.index == child.index and replacement.epoch <> child.epoch;

    let fresh = handles::install(&mut DOMAINS[0].handles, targetSlot, replacement, abi::DOMAIN_RIGHTS);

    assert fresh.bits <> target.bits;

    badHandle(0, target);

    badHandle(replacement.index, oldEvents);

    badHandle(replacement.index, eventsAlias);

    try! contexts::prepare(&mut CONTEXTS[0], replacement, 64, 0, DOMAINS[replacement.index].env);

    badContext(id);

    assert contexts::identity(&CONTEXTS[0]) <> id;

    try! capabilities::drop(&mut KERNEL, 0, external);

    assert POOL.available == 62;

    lifecycle::terminate(&mut KERNEL, root, 4, 0);

    poll();

    assert POOL.available == 64;

    assert domains::live(&DOMAINS[..], replacement);

    assert DOMAINS[replacement.index].parent.kind == abi::Kind::Empty;

}

/// An exited intermediate creator cannot sever a surviving ancestor's cascade.

fn ancestry() {

    let root = setup();

    let ancestor = try! domains::create(&mut DOMAINS[..], root, 0);

    let middle = try! domains::create(&mut DOMAINS[..], ancestor, 0);

    let leaf = try! domains::create(&mut DOMAINS[..], middle, 0);

    let target = handle(0, ancestor, abi::DESTROY);

    lifecycle::terminate(&mut KERNEL, middle, 4, 17);

    poll();

    assert domains::live(&DOMAINS[..], leaf);

    assert DOMAINS[leaf.index].parent.kind == abi::Kind::Empty;

    let replacement = try! domains::create(&mut DOMAINS[..], root, 0);

    assert replacement.index == middle.index and replacement.epoch <> middle.epoch;

    let unrelated = handle(0, replacement, abi::DESTROY);

    let _replacement = try! lifecycle::request(&mut KERNEL, 0, unrelated, 1);

    assert domains::live(&DOMAINS[..], leaf);

    poll();

    let _ancestor = try! lifecycle::request(&mut KERNEL, 0, target, 1);

    assert not domains::live(&DOMAINS[..], ancestor) and not domains::live(&DOMAINS[..], leaf);

    poll();

    assert lifecycle::completed(&DOMAINS[..], ancestor) and lifecycle::completed(&DOMAINS[..], leaf);

    assert domains::live(&DOMAINS[..], root);

}

/// Noncascade destruction leaves creation descendants alive and parentless.

fn survival() {

    let root = setup();

    let child = try! domains::create(&mut DOMAINS[..], root, 0);

    let leaf = try! domains::create(&mut DOMAINS[..], child, 0);

    let denied = handle(0, child, abi::WAKE);

    badRequest(0, denied, 0, abi::Error::Denied);

    badRequest(child.index, abi::Handle { bits: 0 }, 1, abi::Error::InvalidArg);

    badRequest(0, denied, 2, abi::Error::InvalidArg);

    let _owner = try! lifecycle::request(&mut KERNEL, child.index, abi::Handle { bits: 0 }, 0);

    lifecycle::terminate(&mut KERNEL, child, 3, 99);

    poll();

    assert domains::live(&DOMAINS[..], leaf);

    assert DOMAINS[leaf.index].parent.kind == abi::Kind::Empty;

    assert DOMAINS[0].events.ring.data[0].kind == 4 and DOMAINS[0].events.ring.data[0].code == 0;

    lifecycle::terminate(&mut KERNEL, leaf, 3, 42);

    poll();

    assert lifecycle::completed(&DOMAINS[..], leaf);

    assert DOMAINS[0].events.ring.tail == 1;

}

/// Require failed reparent operations to leave their relationship usable.

fn badReparent(child: abi::Handle, parent: abi::Handle, expected: abi::Error) {

    try lifecycle::reparent(&mut KERNEL, 0, child, parent) catch error {

        assert error == expected;

        return;

    };

    panic "badReparent: invalid parent accepted";

}

/// Credit exhaustion is transactional; queued notifications never change owner.

fn parenting() {

    let root = setup();

    let child = try! domains::create(&mut DOMAINS[..], root, 0);

    let receiver = try! domains::create(&mut DOMAINS[..], root, 0);

    let prior = try! domains::create(&mut DOMAINS[..], root, 0);

    lifecycle::terminate(&mut KERNEL, prior, 4, 13);

    poll();

    let target = handle(0, child, abi::DESTROY);

    let parent = handle(0, receiver, abi::WAKE);

    let weakParent = handle(0, receiver, abi::DESTROY);

    badReparent(target, weakParent, abi::Error::Denied);

    badReparent(target, abi::Handle { bits: 0 }, abi::Error::BadHandle);

    badReparent(target, handle(0, child, abi::WAKE), abi::Error::InvalidArg);

    for i in 0..events::CRITICAL {

        try! events::reserve(&mut DOMAINS[receiver.index].events);

        try! events::push(&mut DOMAINS[receiver.index].events,

            events::Event { kind: 4, reserved: 0, code: i, value: 99 }, events::Class::Critical);

    }

    badReparent(target, parent, abi::Error::Exhausted);

    assert DOMAINS[child.index].parent.index == root.index;

    assert DOMAINS[0].events.reserved == 3;

    set DOMAINS[receiver.index].events.ring.head = 1;

    try! lifecycle::reparent(&mut KERNEL, 0, target, parent);

    assert DOMAINS[0].events.reserved == 2;

    // Same-parent no-op must not require a second delivery credit.

    try! lifecycle::reparent(&mut KERNEL, 0, target, parent);

    assert DOMAINS[receiver.index].events.reserved == events::CRITICAL;

    lifecycle::terminate(&mut KERNEL, child, 3, 77);

    lifecycle::terminate(&mut KERNEL, child, 4, 12);

    poll();

    assert DOMAINS[0].events.ring.tail == 1;

    assert DOMAINS[0].events.ring.data[0].code == 13 and DOMAINS[0].events.ring.data[0].value == prior.index as u64;

    let event = DOMAINS[receiver.index].events.ring.data[events::CRITICAL];

    assert event.kind == 3 and event.code == 77 and event.value == child.index as u64;

    assert DOMAINS[receiver.index].events.ring.data[1].value == 99;

    set DOMAINS[receiver.index].events.ring.head = events::CRITICAL + 1;

    try! events::refresh(&mut DOMAINS[receiver.index].events);

    assert DOMAINS[receiver.index].events.reserved == 0;

}

/// Malformed parent progress cannot drop a child's reserved terminal report.

fn invalidParent() {

    let root = setup();

    let child = try! domains::create(&mut DOMAINS[..], root, 0);

    lifecycle::terminate(&mut KERNEL, child, 4, 5);

    set DOMAINS[0].events.ring.head = 1;

    if let bad = lifecycle::poll(&mut KERNEL) {

        assert bad.index == root.index and bad.epoch == root.epoch;

        assert not lifecycle::completed(&DOMAINS[..], child);

        assert DOMAINS[0].events.reserved == 1;

        lifecycle::terminate(&mut KERNEL, bad, 3, 1);

    } else { panic "invalidParent: invalid consumer not reported"; }

    poll();

    assert lifecycle::completed(&DOMAINS[..], root) and lifecycle::completed(&DOMAINS[..], child);

}

/// Exercise lifecycle through real authority, accounting, and event mechanisms.

export fn run() {

    quiescence();

    ancestry();

    survival();

    parenting();

    invalidParent();

}

export mod lifecycle;

//! Serialized domain termination, parent credits, and quiescent reclamation.

use core::abi;

use core::budget_caps;

use core::contexts;

use core::cpu;

use core::domains;

use core::events;

use core::frames;

use core::handles;

use core::memory;

use core::resources;

use core::state;

/// Compare incarnation-qualified identities, including their object kind.

fn same(left: abi::Object, right: abi::Object) -> bool {

    return left.kind == right.kind and left.index == right.index and left.epoch == right.epoch;

}

/// Record the first trusted Exit (4) or Fault (3), without creation cascade.

/// Hold the global state lock. Running harts must finish their charged intervals

/// and relinquish architectural frames before poll can reclaim this owner.

/// A stale owner or an already terminal incarnation cannot rewrite the cause.

export fn terminate(kernel: *mut state::State, owner: abi::Object, kind: u16, code: u32) {

    assert kind == 3 or kind == 4;

    if not domains::live(kernel.domains, owner) { return; }

    let domain = &mut kernel.domains[owner.index];

    set domain.terminalKind = kind;

    set domain.terminalCode = code;

    set domain.state = domains::Lifecycle::Dying;

}

/// Accept teardown under the global lock and return its named incarnation.

/// Zero names self only with zero flags; explicit handles require Destroy.

/// Bit zero selects creation descendants, independently of current parents.

/// Acceptance immediately denies new activation, dispatch, and object lookup;

/// the caller must drive hart quiescence and poll before reporting completion.

export fn request(kernel: *mut state::State, caller: u32, handle: abi::Handle, flags: u64) -> abi::Object throws (abi::Error) {

    if flags & ~1 <> 0 or (handle.bits == 0 and flags <> 0) { throw abi::Error::InvalidArg; }

    assert caller < kernel.domains.len;

    let mut owner = abi::Object { kind: abi::Kind::Domain, index: caller, epoch: kernel.domains[caller].epoch };

    if not domains::live(kernel.domains, owner) { throw abi::Error::BadHandle; }

    if handle.bits <> 0 { set owner = try domains::resolve(kernel.domains, caller, handle, abi::DESTROY); }

    terminate(kernel, owner, 4, 0);

    if flags & 1 <> 0 {

        let word = owner.index / 64;

        let bit = 1 as u64 << (owner.index as u64 & 63);

        for i in 0..kernel.domains.len {

            let domain = &kernel.domains[i];

            if domain.ancestors[word] & bit <> 0 {

                terminate(kernel, abi::Object { kind: abi::Kind::Domain, index: i, epoch: domain.epoch }, 4, 0);

            }

        }

    }

    return owner;

}

/// Cancel only the unfulfilled reservation owned by a current relationship.

/// Queued terminal entries no longer have a relationship and are never moved

/// or canceled here. A matching Dying parent still owns its private queue.

fn detach(table: *mut [domains::Domain], index: u32) {

    let parent = table[index].parent;

    if parent.kind == abi::Kind::Domain and parent.index < table.len {

        let receiver = &mut table[parent.index];

        if receiver.epoch == parent.epoch and receiver.state <> domains::Lifecycle::Dead {

            assert receiver.events.reserved > 0;

            set receiver.events.reserved -= 1;

        }

    }

    set table[index].parent = domains::none();

}

/// Atomically change terminal receiver under the global lock, not ancestry.

/// Destroy on the child and Wake on the new parent are both required.

/// Reserve before canceling the old unfulfilled credit; failure keeps the old

/// relationship intact. Already queued events stay in their original queue.

export fn reparent(kernel: *mut state::State, caller: u32, childHandle: abi::Handle, parentHandle: abi::Handle) throws (abi::Error) {

    let child = try domains::resolve(kernel.domains, caller, childHandle, abi::DESTROY);

    let parent = try domains::resolve(kernel.domains, caller, parentHandle, abi::WAKE);

    if same(child, parent) { throw abi::Error::InvalidArg; }

    if same(kernel.domains[child.index].parent, parent) { return; }

    try events::reserve(&mut kernel.domains[parent.index].events);

    detach(kernel.domains, child.index);

    set kernel.domains[child.index].parent = parent;

}

/// Test completion of the named incarnation, not merely loss of authority.

/// Cascade callers must also wait for their selected descendant incarnations;

/// capture that bounded set under the same lock as request, before slot reuse.

export fn completed(table: *[domains::Domain], owner: abi::Object) -> bool {

    assert owner.kind == abi::Kind::Domain and owner.epoch <> 0 and owner.index < table.len;

    return table[owner.index].epoch <> owner.epoch or table[owner.index].state == domains::Lifecycle::Dead;

}

/// All physical addresses are discarded only after architectural ownership ends.

fn emptyEnv() -> domains::Env {

    return domains::Env {

        argsPointer: 0, argsSize: 0, eventsHandle: 0, eventsPointer: 0,

        stateBase: 0, stackBase: 0, stackTop: 0, context: 0,

        privateStackBase: 0, privateStackTop: 0,

    };

}

/// Remove trusted authority, including installed Events, and release Page claims.

fn remove(kernel: *mut state::State, owner: u32, slot: u32) {

    let entry = handles::remove(&mut kernel.domains[owner].handles, slot);

    if let run = resources::release(kernel.resources, entry.object) {

        memory::release(&mut kernel.memory, run);

    }

}

/// Reclaim a quiescent owner after terminal publication or loss of its parent.

/// Retained budget bindings precede private-stack release and slot invalidation.

fn reclaim(kernel: *mut state::State, owner: abi::Object) {

    for i in 0..kernel.contexts.len {

        let context = &mut kernel.contexts[i];

        if context.status == contexts::Status::Vacant or not same(context.owner, owner) { continue; }

        assert context.status <> contexts::Status::Running;

        budget_caps::unbind(kernel, context);

        if context.private.count > 0 { frames::reclaim(kernel.memory.pool, context.private); }

        set context.private = frames::Run { first: 0, count: 0 };

        set context.status = contexts::Status::Vacant;

        set context.owner = domains::none();

        set context.hart = contexts::NO_HART;

        set context.continuation = 0;

        set context.deadline = 0;

        set context.env = emptyEnv();

        cpu::init(&mut context.frame, 0, 0, 0, 0);

    }

    for slot in 0..abi::MAX_HANDLES {

        if kernel.domains[owner.index].handles.entries[slot].object.kind <> abi::Kind::Empty {

            remove(kernel, owner.index, slot);

        }

    }

    // Removing dead Domain/Events entries advances packed-name generations.

    // These objects carry no physical-resource reference counts.

    for i in 0..kernel.domains.len {

        let domain = &kernel.domains[i];

        if domain.state <> domains::Lifecycle::Pending and domain.state <> domains::Lifecycle::Active { continue; }

        for slot in 0..abi::MAX_HANDLES {

            let object = domain.handles.entries[slot].object;

            if (object.kind == abi::Kind::Domain or object.kind == abi::Kind::Events)

                and not resources::live(kernel.resources, kernel.domains, object) {

                remove(kernel, i, slot);

            }

        }

    }

    memory::retire(&mut kernel.memory, owner.index);

    let domain = &mut kernel.domains[owner.index];

    if domain.private.count > 0 { frames::reclaim(kernel.memory.pool, domain.private); }

    set domain.private = frames::Run { first: 0, count: 0 };

    set domain.env = emptyEnv();

    events::init(&mut domain.events);

    set domain.state = domains::Lifecycle::Dead;

}

/// Make one bounded reclamation pass under the global lock; never stop a hart.

/// Orphan relationships to nonlive parents, including children still Running.

/// No owner is reclaimed while any of its contexts is Running. An invalid

/// live parent consumer returns that identity without reclaiming its child:

/// apply trusted Fault termination to the returned parent, then poll again.

/// Terminal values use the public domain index; private epochs protect reuse.

export fn poll(kernel: *mut state::State) -> ?abi::Object {

    for i in 0..kernel.domains.len {

        let domain = &kernel.domains[i];

        if domain.state == domains::Lifecycle::Dead { continue; }

        if domain.parent.kind == abi::Kind::Domain and not domains::live(kernel.domains, domain.parent) {

            detach(kernel.domains, i);

        }

    }

    for i in 0..kernel.domains.len {

        let domain = &mut kernel.domains[i];

        if domain.state <> domains::Lifecycle::Dying { continue; }

        let owner = abi::Object { kind: abi::Kind::Domain, index: i, epoch: domain.epoch };

        let mut running = false;

        for c in 0..kernel.contexts.len {

            let context = &kernel.contexts[c];

            if context.status == contexts::Status::Running and same(context.owner, owner) { set running = true; }

        }

        if running { continue; }

        let parent = domain.parent;

        if domains::live(kernel.domains, parent) {

            try events::push(&mut kernel.domains[parent.index].events, events::Event {

                kind: domain.terminalKind, reserved: 0, code: domain.terminalCode, value: i as u64,

            }, events::Class::Critical) catch { return parent; };

            // Publication consumes the relationship, not its queued reservation.

            set domain.parent = domains::none();

        }

        reclaim(kernel, owner);

    }

    return nil;

}

use core::domains;

use core::lifecycle;

    let secondOwner = try! domains::resolve(kernel.domains, 0, second, 0);

    let retired = try! lifecycle::request(kernel, 0, first, 0);

    if let _bad = lifecycle::poll(kernel) { panic "run: invalid lifecycle consumer"; }

    assert lifecycle::completed(kernel.domains, retired);

    assert domains::live(kernel.domains, secondOwner);

    let fresh = try! activation::create(kernel, 0, own, image, physical::clear, physical::copy);

    let _page = try! capabilities::grant(kernel, 0, page, fresh, (abi::READ | abi::WRITE) as u64);

    let freshId = try! activation::activate(kernel, 0, fresh, top, range.base, 4, physical::clear);

    execute(kernel, fresh, freshId, clint, 42);