core/budgets.rad core/contexts.rad core/clock.rad core/budget_caps.rad \

	core/timers.rad core/notifications.rad

	check/budgets.rad check/budget_caps.rad check/timers.rad check/notifications.rad

context.rv64: context.rad context/wait.rad check/context.ras arch/entry.ras core.rad $(MODULES) $(CORE_ASM) $(COMPILER)

	$(COMPILE) $(CORE) -pkg context -start arch/entry.ras -mod context.rad -mod context/wait.rad -mod check/context.ras -entry context -o $@

record the contracts established through step 13 of the 22-step plan.

## Waits and one-shot timeouts

- Each hart owns 64 timeout slots. An accepted timeout remains allocated until

  publication succeeds or its exact owner incarnation dies. Busy cannot erase

  accepted work. Rotating delivery prevents low-slot reuse from starving it.

- Program the earlier of the current budget deadline and a future timeout.

  Already-due backpressured timeouts do not cause interrupt spin; kernel entry

  retries publication.

- Wait validates consumer progress before blocking. Resumption requires an

  unread event and positive retained budget. Wakeup requires an explicit Wake

  handle and records the sender identity. Idle waiting does not consume ticks

  from the suspended context's budget.

Exercise Timeout, Wait, machine idle, timer expiry, event consumption, retained notifications, and unchanged budget during idle.

mod timers;

mod notifications;

    timers::run();

    notifications::run();

.export @"context::wait::entry";

@"context::wait::entry"

	la     %a0    @wait_entry;

	ret;

@wait_entry

	li     %a0    10000;

	li     %a1    7;

	li     %a7    41;

	ecall;

	li     %a7    42;

	ecall;

	ld     %t0    24(%tp);

	li     %t2    4096;

	add    %t2    %t0    %t2;

	lwu    %t1    0(%t2);

	lwu    %t3    4(%t2);

	fence;

	beq    %t1    %t3    @wait_failed;

	andi   %t4    %t1    255;

	slli   %t4    %t4    4;

	add    %t4    %t0    %t4;

	lhu    %t5    0(%t4);

	li     %t6    2;

	bne    %t5    %t6    @wait_failed;

	lwu    %t5    4(%t4);

	li     %t6    7;

	bne    %t5    %t6    @wait_failed;

	ld     %t5    8(%t4);

	bnez   %t5    @wait_failed;

	addi   %t1    %t1    1;

	fence;

	sw     %t1    0(%t2);

	li     %a0    42;

	li     %a7    49;

	ecall;

@wait_failed

	li     %a0    100;

	li     %a7    49;

	ecall;

//! Wait predicates, explicit Wake authority, and budget-neutral notification.

use core::abi;

use core::atomic;

use core::budget_caps;

use core::budgets;

use core::capabilities;

use core::contexts;

use core::domains;

use core::events;

use core::frames;

use core::handles;

use core::memory;

use core::notifications;

use core::platform;

use core::resources;

use core::state;

/// Independent sender and receiver domain storage.

static DOMAINS: [domains::Domain; 2] = undefined;

/// Reserve and execution-loan resource slots.

static OBJECTS: [resources::Slot; 3] = undefined;

/// Waiting receiver context.

static CONTEXTS: [contexts::Context; 1] = undefined;

/// Empty, valid frame metadata for this notification-only fixture.

static POOL: frames::Pool = undefined;

/// Empty-pool pin counts.

static PINS: [u16; 1] = undefined;

/// Empty-pool claims.

static ASSIGNED: [bool; 1] = undefined;

/// Empty-pool grants.

static GRANTS: [u64; 2] = undefined;

/// Kernel mechanism storage.

static KERNEL: state::State = undefined;

/// Consume the receiver's next Wakeup with acquire/release progress.

fn consume(token: u32, sender: u32) {

    let queue = &mut DOMAINS[1].events;

    let head = atomic::load(&queue.ring.head);

    assert head <> atomic::load(&queue.ring.tail);

    let event = queue.ring.data[head & (events::CAPACITY - 1)];

    assert event.kind == 5 and event.code == token and event.value == sender as u64;

    atomic::store(&mut queue.ring.head, head + 1);

}

/// Reject the identity-only sentinel where an explicit Wake capability is required.

fn noAuthority() {

    try notifications::wakeup(&mut KERNEL, 0, abi::Handle { bits: 0 }, 99) catch error {

        assert error == abi::Error::BadHandle;

        return;

    };

    panic "noAuthority: sentinel authorized a wakeup";

}

/// A retained event cannot wake an exhausted context until authority is assigned.

export fn run() {

    domains::init(&mut DOMAINS[..]);

    contexts::init(&mut CONTEXTS[0], 0);

    resources::init(&mut OBJECTS[..]);

    let mut machine: platform::Platform = undefined;

    set machine.memoryCount = 0;

    set machine.reservedCount = 0;

    try! frames::init(&mut POOL, &machine);

    let mut ram: memory::Memory = undefined;

    memory::init(&mut ram, &mut POOL, &mut PINS[..], &mut ASSIGNED[..], &mut GRANTS[..], 2);

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], contexts: &mut CONTEXTS[..], memory: ram };

    let rootHandle = domains::root(&mut DOMAINS[..], 0);

    let root = try! domains::resolve(&DOMAINS[..], 0, rootHandle, abi::CREATE);

    let child = try! domains::create(&mut DOMAINS[..], root, 0);

    let target = handles::install(&mut DOMAINS[0].handles, 2, child, abi::DOMAIN_RIGHTS);

    set DOMAINS[0].state = domains::Lifecycle::Active;

    set DOMAINS[1].state = domains::Lifecycle::Active;

    try! contexts::prepare(&mut CONTEXTS[0], child, 0, 0, DOMAINS[1].env);

    let id = contexts::identity(&CONTEXTS[0]);

    let object = try! resources::create(&mut OBJECTS[..], resources::Value::Budget(try! budgets::init(0, 2000)));

    resources::retain(&mut OBJECTS[..], object);

    let reserve = handles::install(&mut DOMAINS[0].handles, 3, object, abi::READ | abi::WRITE | abi::EXECUTE);

    let loan = try! budget_caps::split(&mut KERNEL, 0, reserve, 1000);

    try! budget_caps::bind(&mut KERNEL, 0, loan, target, id);

    let own = try! capabilities::grant(&mut KERNEL, 0, target, target, abi::WAKE as u64);

    noAuthority();

    try! notifications::wait(&mut KERNEL, 0);

    assert CONTEXTS[0].status == contexts::Status::Waiting;

    try! notifications::wakeup(&mut KERNEL, 1, own, 77);

    assert notifications::poll(&mut KERNEL) == nil;

    assert CONTEXTS[0].status == contexts::Status::Ready;

    consume(77, 1);

    let budget = budget_caps::value(&mut KERNEL, CONTEXTS[0].budget);

    let running = try! contexts::begin(&mut CONTEXTS[0], budget, 1, 0);

    assert contexts::finish(&mut CONTEXTS[0], budget, running, 1001) == 0;

    try! notifications::wait(&mut KERNEL, 0);

    try! notifications::wakeup(&mut KERNEL, 0, target, 42);

    assert notifications::poll(&mut KERNEL) == nil;

    assert CONTEXTS[0].status == contexts::Status::Waiting and budget.remaining == 0;

    let more = try! budget_caps::split(&mut KERNEL, 0, reserve, 500);

    try! budget_caps::bind(&mut KERNEL, 0, more, target, id);

    assert notifications::poll(&mut KERNEL) == nil;

    try! notifications::wait(&mut KERNEL, 0);

    assert CONTEXTS[0].status == contexts::Status::Ready;

    consume(42, 0);

    try! notifications::wait(&mut KERNEL, 0);

    atomic::store(&mut DOMAINS[1].events.ring.head, 3);

    let bad = notifications::poll(&mut KERNEL) else { panic "run: corrupt wait queue was accepted"; };

    assert bad.index == child.index and bad.epoch == child.epoch;

}

//! One-shot timeout delivery, bounded retention, and incarnation isolation.

use core::abi;

use core::atomic;

use core::domains;

use core::events;

use core::handles;

use core::timers;

/// Real domain storage kept off the boot check stack.

static DOMAINS: [domains::Domain; 2] = undefined;

/// Reset private stores and return root's live domain identity.

fn setup(store: *mut timers::Store) -> abi::Object {

    timers::init(store);

    domains::init(&mut DOMAINS[..]);

    let root = domains::root(&mut DOMAINS[..], 0);

    return try! domains::resolve(&DOMAINS[..], 0, root, abi::CREATE);

}

/// Acquire a complete notification and release the consumer's new position.

fn pop(queue: *mut events::Queue) -> events::Event {

    let head = atomic::load(&queue.ring.head);

    assert head <> atomic::load(&queue.ring.tail);

    let event = queue.ring.data[head & queue.ring.mask];

    atomic::store(&mut queue.ring.head, ((head as u64 + 1) & 0xffffffff) as u32);

    return event;

}

/// Observe published producer progress without touching private queue counters.

fn empty(queue: *events::Queue) -> bool {

    return atomic::load(&queue.ring.head) == atomic::load(&queue.ring.tail);

}

/// Require the complete public Timeout payload, including its reserved fields.

fn timeout(queue: *mut events::Queue, token: u32) {

    let event = pop(queue);

    assert event.kind == 2 and event.reserved == 0;

    assert event.code == token and event.value == 0;

}

/// Require rejection instead of accepting an additional timeout.

fn rejected(store: *mut timers::Store, owner: abi::Object, now: u64, delay: u64, expected: abi::Error) {

    try timers::arm(store, owner, now, delay, 0xffffffff) catch error {

        assert error == expected;

        return;

    };

    panic "rejected: invalid or full timer store accepted a timeout";

}

/// Future deadlines do not publish early, and late entries still publish once.

fn timing() {

    let mut store: timers::Store = undefined;

    let root = setup(&mut store);

    let queue = &mut DOMAINS[0].events;

    assert timers::next(&store, 100) == 0xffffffffffffffff;

    try! timers::arm(&mut store, root, 100, 10, 0xfedcba98);

    try! timers::arm(&mut store, root, 100, 5, 0);

    assert timers::next(&store, 100) == 105;

    timers::deliver(&mut store, 104, &mut DOMAINS[..]);

    assert empty(queue);

    timers::deliver(&mut store, 105, &mut DOMAINS[..]);

    timeout(queue, 0);

    assert empty(queue) and timers::next(&store, 105) == 110;

    timers::deliver(&mut store, 109, &mut DOMAINS[..]);

    assert empty(queue);

    timers::deliver(&mut store, 120, &mut DOMAINS[..]);

    timeout(queue, 0xfedcba98);

    timers::deliver(&mut store, 121, &mut DOMAINS[..]);

    assert empty(queue) and timers::next(&store, 121) == 0xffffffffffffffff;

}

/// Full-store rejection leaves every accepted token intact and frees no slot.

fn capacity() {

    let mut store: timers::Store = undefined;

    let root = setup(&mut store);

    let queue = &mut DOMAINS[0].events;

    for i in 0..timers::CAPACITY { try! timers::arm(&mut store, root, 0, 10, i); }

    rejected(&mut store, root, 0, 1, abi::Error::Busy);

    assert timers::next(&store, 0) == 10;

    timers::deliver(&mut store, 10, &mut DOMAINS[..]);

    for i in 0..timers::CAPACITY { timeout(queue, i); }

    assert empty(queue);

    try! timers::arm(&mut store, root, 10, 1, 64);

    timers::deliver(&mut store, 11, &mut DOMAINS[..]);

    timeout(queue, 64);

    timers::deliver(&mut store, 12, &mut DOMAINS[..]);

    assert empty(queue);

}

/// A completely full real ring retains an expired timer until consumption.

fn backpressure() {

    let mut store: timers::Store = undefined;

    let root = setup(&mut store);

    let queue = &mut DOMAINS[0].events;

    for i in 0..events::CAPACITY - events::CRITICAL {

        try! events::push(queue, events::Event { kind: 5, reserved: 0, code: i, value: i as u64 }, events::Class::Ordinary);

    }

    for i in 0..events::CRITICAL {

        try! events::reserve(queue);

        try! events::push(queue, events::Event { kind: 4, reserved: 0, code: i, value: i as u64 }, events::Class::Critical);

    }

    try! timers::arm(&mut store, root, 0, 5, 0x12345678);

    try! timers::arm(&mut store, root, 0, 20, 20);

    timers::deliver(&mut store, 5, &mut DOMAINS[..]);

    timers::deliver(&mut store, 6, &mut DOMAINS[..]);

    assert atomic::load(&queue.ring.tail) == events::CAPACITY;

    assert timers::next(&store, 6) == 20;

    assert pop(queue).kind == 5;

    timers::deliver(&mut store, 7, &mut DOMAINS[..]);

    timers::deliver(&mut store, 8, &mut DOMAINS[..]);

    assert atomic::load(&queue.ring.tail) == events::CAPACITY + 1;

    for i in 1..events::CAPACITY - events::CRITICAL {

        let event = pop(queue);

        assert event.kind == 5 and event.code == i and event.value == i as u64;

    }

    for i in 0..events::CRITICAL {

        let event = pop(queue);

        assert event.kind == 4 and event.code == i and event.value == i as u64;

    }

    timeout(queue, 0x12345678);

    assert empty(queue);

    timers::deliver(&mut store, 20, &mut DOMAINS[..]);

    timeout(queue, 20);

    timers::deliver(&mut store, 21, &mut DOMAINS[..]);

    assert empty(queue) and timers::next(&store, 21) == 0xffffffffffffffff;

}

/// A reused low slot cannot steal the next free event position from a survivor.

fn rotation() {

    let mut store: timers::Store = undefined;

    let root = setup(&mut store);

    let queue = &mut DOMAINS[0].events;

    for i in 0..events::CAPACITY - events::CRITICAL - 1 {

        try! events::push(queue, events::Event { kind: 5, reserved: 0, code: i, value: 0 }, events::Class::Ordinary);

    }

    try! timers::arm(&mut store, root, 0, 1, 10);

    try! timers::arm(&mut store, root, 0, 1, 11);

    timers::deliver(&mut store, 1, &mut DOMAINS[..]);

    assert timers::next(&store, 1) == 0xffffffffffffffff;

    assert pop(queue).kind == 5;

    try! timers::arm(&mut store, root, 1, 1, 12);

    timers::deliver(&mut store, 2, &mut DOMAINS[..]);

    for i in 1..events::CAPACITY - events::CRITICAL - 1 { assert pop(queue).code == i; }

    timeout(queue, 10);

    timeout(queue, 11);

    assert empty(queue);

    timers::deliver(&mut store, 3, &mut DOMAINS[..]);

    timeout(queue, 12);

    timers::deliver(&mut store, 4, &mut DOMAINS[..]);

    assert empty(queue);

}

/// Delay arithmetic rejects wraparound but accepts the last representable tick.

fn deadlines() {

    let mut store: timers::Store = undefined;

    let root = setup(&mut store);

    let queue = &mut DOMAINS[0].events;

    rejected(&mut store, root, 0, 0, abi::Error::InvalidArg);

    rejected(&mut store, root, 0xffffffffffffffff, 1, abi::Error::InvalidArg);

    rejected(&mut store, root, 0xfffffffffffffffe, 2, abi::Error::InvalidArg);

    try! timers::arm(&mut store, root, 0xfffffffffffffffe, 1, 99);

    timers::deliver(&mut store, 0xfffffffffffffffe, &mut DOMAINS[..]);

    assert empty(queue);

    timers::deliver(&mut store, 0xffffffffffffffff, &mut DOMAINS[..]);

    timeout(queue, 99);

    timers::deliver(&mut store, 0xffffffffffffffff, &mut DOMAINS[..]);

    assert empty(queue);

}

/// Cancellation compares kind, index, and epoch, never merely a domain slot.

fn cancellation() {

    let mut store: timers::Store = undefined;

    let root = setup(&mut store);

    let child = try! domains::create(&mut DOMAINS[..], root, 1);

    try! timers::arm(&mut store, root, 0, 5, 1);

    try! timers::arm(&mut store, child, 0, 5, 2);

    timers::cancel(&mut store, root);

    timers::cancel(&mut store, abi::Object { kind: abi::Kind::Events, index: child.index, epoch: child.epoch });

    timers::cancel(&mut store, abi::Object { kind: child.kind, index: child.index, epoch: child.epoch + 1 });

    timers::deliver(&mut store, 5, &mut DOMAINS[..]);

    assert empty(&DOMAINS[root.index].events);

    timeout(&mut DOMAINS[child.index].events, 2);

    try! timers::arm(&mut store, child, 5, 1, 3);

    try! timers::arm(&mut store, child, 5, 2, 4);

    timers::cancel(&mut store, child);

    timers::deliver(&mut store, 7, &mut DOMAINS[..]);

    assert empty(&DOMAINS[child.index].events);

    assert timers::next(&store, 7) == 0xffffffffffffffff;

}

/// Reallocated domain slots cannot receive old timeouts or old cancellation.

fn incarnations() {

    let mut store: timers::Store = undefined;

    let root = setup(&mut store);

    let old = try! domains::create(&mut DOMAINS[..], root, 1);

    try! timers::arm(&mut store, old, 0, 5, 1);

    set DOMAINS[old.index].state = domains::Lifecycle::Dead;

    handles::init(&mut DOMAINS[old.index].handles);

    let current = try! domains::create(&mut DOMAINS[..], root, 2);

    assert current.index == old.index and current.epoch <> old.epoch;

    try! timers::arm(&mut store, current, 0, 5, 2);

    timers::deliver(&mut store, 5, &mut DOMAINS[..]);

    timeout(&mut DOMAINS[current.index].events, 2);

    assert empty(&DOMAINS[current.index].events);

    try! timers::arm(&mut store, current, 5, 5, 3);

    timers::cancel(&mut store, old);

    timers::deliver(&mut store, 10, &mut DOMAINS[..]);

    timeout(&mut DOMAINS[current.index].events, 3);

    try! timers::arm(&mut store, current, 10, 10, 4);

    set DOMAINS[current.index].state = domains::Lifecycle::Dying;

    timers::deliver(&mut store, 11, &mut DOMAINS[..]);

    assert timers::next(&store, 11) == 0xffffffffffffffff;

    set DOMAINS[current.index].state = domains::Lifecycle::Active;

    timers::deliver(&mut store, 20, &mut DOMAINS[..]);

    assert empty(&DOMAINS[current.index].events);

    try! timers::arm(&mut store, abi::Object { kind: abi::Kind::Domain, index: abi::MAX_DOMAINS - 1, epoch: 1 }, 20, 1, 5);

    timers::deliver(&mut store, 21, &mut DOMAINS[..]);

    assert timers::next(&store, 21) == 0xffffffffffffffff;

    rejected(&mut store, domains::none(), 21, 1, abi::Error::BadHandle);

}

/// Exercise timeout acceptance and publication using real domain event stores.

export fn run() {

    timing();

    capacity();

    backpressure();

    rotation();

    deadlines();

    cancellation();

    incarnations();

}

mod wait;

    wait::run();

//! Real Timeout/Wait transitions with a retained finite budget and an idle hart.

use core::abi;

use core::atomic;

use core::budget_caps;

use core::budgets;

use core::clock;

use core::contexts;

use core::cpu;

use core::domains;

use core::frames;

use core::handles;

use core::memory;

use core::notifications;

use core::platform;

use core::resources;

use core::state;

use core::timers;

/// Trusted test program that requests a timeout and consumes its event after Wait.

fn entry() -> u64;

/// One complete domain and event queue.

static DOMAINS: [domains::Domain; 1] = undefined;

/// One retained execution budget.

static OBJECTS: [resources::Slot; 1] = undefined;

/// The user context suspended across Wait.

static CONTEXTS: [contexts::Context; 1] = undefined;

/// Valid empty RAM accounting for this machine-only control-plane check.

static POOL: frames::Pool = undefined;

/// Empty-pool pins.

static PINS: [u16; 1] = undefined;

/// Empty-pool claims.

static ASSIGNED: [bool; 1] = undefined;

/// Empty-pool grants.

static GRANTS: [u64; 1] = undefined;

/// Private one-shot timer storage.

static TIMERS: timers::Store = undefined;

/// Shared kernel mechanisms.

static KERNEL: state::State = undefined;

/// Resume one authorized user interval until a real trap and charge it once.

unsafe fn step() -> u64 {

    let context = &mut CONTEXTS[0];

    let budget = budget_caps::value(&mut KERNEL, context.budget);

    let start = clock::read(0x02000000);

    let running = try! contexts::begin(context, budget, start, 0);

    let timeout = timers::next(&TIMERS, start);

    let mut deadline = context.deadline;

    if timeout < deadline { set deadline = timeout; }

    clock::arm(0x02000000, 0, deadline);

    clock::interrupts(128);

    cpu::enter(&mut context.frame);

    let now = clock::read(0x02000000);

    clock::interrupts(0);

    assert contexts::finish(context, budget, running, now) > 0;

    return now;

}

/// An idle interval neither consumes nor replenishes the waiting context's budget.

export unsafe fn run() {

    domains::init(&mut DOMAINS[..]);

    contexts::init(&mut CONTEXTS[0], 0);

    resources::init(&mut OBJECTS[..]);

    timers::init(&mut TIMERS);

    let mut machine: platform::Platform = undefined;

    set machine.memoryCount = 0;

    set machine.reservedCount = 0;

    try! frames::init(&mut POOL, &machine);

    let mut ram: memory::Memory = undefined;

    memory::init(&mut ram, &mut POOL, &mut PINS[..], &mut ASSIGNED[..], &mut GRANTS[..], 1);

    set KERNEL = state::State { domains: &mut DOMAINS[..], resources: &mut OBJECTS[..], contexts: &mut CONTEXTS[..], memory: ram };

    let handle = domains::root(&mut DOMAINS[..], 0);

    let root = try! domains::resolve(&DOMAINS[..], 0, handle, abi::EXECUTE);

    set DOMAINS[0].state = domains::Lifecycle::Active;

    set DOMAINS[0].env.eventsPointer = &DOMAINS[0].events.ring as u64;

    try! contexts::prepare(&mut CONTEXTS[0], root, entry(), 0, DOMAINS[0].env);

    let object = try! resources::create(&mut OBJECTS[..], resources::Value::Budget(try! budgets::init(0, 100000)));

    resources::retain(&mut OBJECTS[..], object);

    let authority = handles::install(&mut DOMAINS[0].handles, 2, object, abi::EXECUTE);

    try! budget_caps::bind(&mut KERNEL, 0, authority, handle, contexts::identity(&CONTEXTS[0]));

    let now = step();

    let frame = &mut CONTEXTS[0].frame;

    assert frame.cause == 8 and frame.registers[17] == 41;

    try! timers::arm(&mut TIMERS, root, now, frame.registers[10], frame.registers[11] as u32);

    cpu::reply(frame, abi::Error::Ok, 0, 0, 0, 0);

    let blocked = step();

    assert frame.cause == 8 and frame.registers[17] == 42;

    cpu::reply(frame, abi::Error::Ok, 0, 0, 0, 0);

    try! notifications::wait(&mut KERNEL, 0);

    assert CONTEXTS[0].status == contexts::Status::Waiting;

    let remaining = budget_caps::value(&mut KERNEL, object).remaining;

    let deadline = timers::next(&TIMERS, blocked);

    clock::arm(0x02000000, 0, deadline);

    clock::interrupts(128);

    let mut idle: cpu::Frame = undefined;

    cpu::init(&mut idle, 0, 0, 0, 0);

    cpu::idle(&mut idle);

    let expired = clock::read(0x02000000);

    clock::interrupts(0);

    clock::arm(0x02000000, 0, 0xffffffffffffffff);

    assert idle.cause == 0x8000000000000007 and expired >= deadline;

    assert budget_caps::value(&mut KERNEL, object).remaining == remaining;

    timers::deliver(&mut TIMERS, expired, &mut DOMAINS[..]);

    assert notifications::poll(&mut KERNEL) == nil;

    assert CONTEXTS[0].status == contexts::Status::Ready;

    let _finished = step();

    clock::arm(0x02000000, 0, 0xffffffffffffffff);

    assert frame.cause == 8 and frame.registers[17] == 49 and frame.registers[10] == 42;

    timers::deliver(&mut TIMERS, expired + 1, &mut DOMAINS[..]);

    assert atomic::load(&DOMAINS[0].events.ring.head) == atomic::load(&DOMAINS[0].events.ring.tail);

}

export mod timers;

export mod notifications;

//! Event-driven context waits; notification never supplies execution authority.

use core::abi;

use core::budget_caps;

use core::contexts;

use core::domains;

use core::events;

use core::state;

/// Block a quiescent current context only after validating the unread-event predicate.

export fn wait(kernel: *mut state::State, index: u32) throws (abi::Error) {

    let context = &mut kernel.contexts[index];

    if context.status <> contexts::Status::Ready { throw abi::Error::Busy; }

    if not domains::live(kernel.domains, context.owner) { throw abi::Error::BadHandle; }

    let queue = &mut kernel.domains[context.owner.index].events;

    try events::refresh(queue);

    if not events::available(queue) { set context.status = contexts::Status::Waiting; }

}

/// Make waiting contexts ready only while both an unread event and retained budget exist.

/// Return a malformed queue owner so the control path can apply fault termination.

export fn poll(kernel: *mut state::State) -> ?abi::Object {

    for i in 0..kernel.contexts.len {

        let context = &mut kernel.contexts[i];

        if context.status <> contexts::Status::Waiting { continue; }

        if not domains::live(kernel.domains, context.owner) { continue; }

        let queue = &mut kernel.domains[context.owner.index].events;

        try events::refresh(queue) catch { return context.owner; };

        if context.budget.kind <> abi::Kind::Budget or not events::available(queue) { continue; }

        let budget = budget_caps::value(kernel, context.budget);

        if budget.remaining > 0 { set context.status = contexts::Status::Ready; }

    }

    return nil;

}

/// Publish a checked Wakeup notification without donating or replenishing budget.

export fn wakeup(kernel: *mut state::State, caller: u32, target: abi::Handle, token: u32) throws (abi::Error) {

    let domain = try domains::resolve(kernel.domains, caller, target, abi::WAKE);

    try events::push(&mut kernel.domains[domain.index].events,

        events::Event { kind: 5, reserved: 0, code: token, value: caller as u64 }, events::Class::Ordinary);

}

//! Bounded one-shot timeouts owned and serialized by one hardware hart.

use core::abi;

use core::domains;

use core::events;

/// Maximum accepted timeouts, including expired notifications under backpressure.

export constant CAPACITY: u32 = 64;

/// One accepted notification; a zero owner epoch marks an unused slot.

export record Timer: Copy {

    /// Complete destination domain incarnation, never a capability-table slot.

    owner: abi::Object,

    /// Absolute monotonic CLINT deadline, private to the kernel.

    deadline: u64,

    /// Caller-supplied Timeout notification code.

    token: u32,

}

/// Fixed private timer storage; all accesses must be serialized by its owning hart.

export record Store: Copy {

    /// Armed and expired-but-unpublished one-shot notifications.

    entries: [Timer; CAPACITY],

    /// First slot examined by the next bounded delivery pass.

    cursor: u32,

}

/// Initialize unused per-hart storage before accepting any timeouts.

export fn init(store: *mut Store) {

    for i in 0..CAPACITY {

        set store.entries[i] = Timer { owner: domains::none(), deadline: 0, token: 0 };

    }

    set store.cursor = 0;

}

/// Accept one positive, non-overflowing delay in monotonic CLINT ticks.

/// The caller authorizes the live owner; malformed identities return BadHandle.

/// InvalidArg and Busy leave all accepted timeouts and delivery order unchanged.

export fn arm(store: *mut Store, owner: abi::Object, now: u64, delay: u64, token: u32) throws (abi::Error) {

    if delay == 0 or now > 0xffffffffffffffff - delay { throw abi::Error::InvalidArg; }

    if owner.kind <> abi::Kind::Domain or owner.index >= abi::MAX_DOMAINS or owner.epoch == 0 {

        throw abi::Error::BadHandle;

    }

    for i in 0..CAPACITY {

        if store.entries[i].owner.epoch == 0 {

            set store.entries[i] = Timer { owner, deadline: now + delay, token };

            return;

        }

    }

    throw abi::Error::Busy;

}

/// Attempt each accepted timeout at most once, retaining failed publications.

/// Timeout entries carry kind=2, code=token, value=0, and reserved=0.

/// Dead, dying, and stale owners are discarded before any destination access.

/// Busy or invalid consumer progress retains the entry until a later kernel entry.

export fn deliver(store: *mut Store, now: u64, table: *mut [domains::Domain]) {

    let start = store.cursor;

    // Advance the starting point even when every publication is backpressured.

    // Repeated reuse of an early free slot cannot monopolize newly freed capacity.

    set store.cursor = (start + 1) % CAPACITY;

    for offset in 0..CAPACITY {