state: State,

    /// Validated timer registers for this hart.

    timer: Timer,

    /// Minimum ticks between scheduled maintenance passes.

    maintenance: u64,

}

/// Runtime slots initialized before each hart enables timer interrupts.

unsafe static HARTS: [Runtime; limits::HARTS] = undefined;

/// Read the executing physical hart identifier.

export fn hart() -> u32;

/// Read the current machine stack pointer.

fn stackPointer() -> u64;

    set idle.registers[2] = stack.end;

    set idle.registers[3] = kernelGp;

    let mut maintenance = machine.timebase as u64 / 100;

    if maintenance == 0 { set maintenance = 1; }

    set HARTS[id] = Runtime {

    };

    arm(device, 0xffffffffffffffff);

}

/// Tail-enter dispatch on the firmware stack and resume the selected frame.

    assert id < limits::HARTS;

    let stack = HARTS[id].state.stack;

    let pointer = stackPointer();

    assert pointer >= stack.start and pointer < stack.end;

    let guard = sync::enter();

    writeSoftware(HARTS[id].timer.software, 0);

    let previous = HARTS[id].state.current;

    save(&mut HARTS[id].state, &mut domains::STORE, frame);

    if trap::classify(frame.cause) == trap::Cause::External { plic::claim(id); }

    let mut deliveries: [remote::Delivery; limits::REMOTE_PER_HART] = undefined;

        }

        set deliveries[count] = delivery;

        set count += 1;

    }

    let clock = now(HARTS[id].timer);

    let timeout = try! timers::service(&mut timers::STORE, &mut domains::STORE, &budgets::STORE, id, clock);

    let choice = try! exchange(&mut HARTS[id].state, &budgets::STORE, &mut domains::STORE, frame, anchor, clock);

    let mut deadline = choice.deadline;

    if timeout.deadline < deadline { set deadline = timeout.deadline; }

    reschedule(notified);

    if previous <> choice.context {

        if let case remote::Action::Budget(call) = delivery.request.action { signalContext(call.context, clock); }

        if let case remote::Action::Ready(context) = delivery.request.action { signalContext(context, clock); }

    }

    lifecycle::cancelRequests(&mut domains::STORE, &mut remote::STORE);

    let cancelled = lifecycle::cancelAllocations(&mut lifecycle::CALLS, &mut domains::STORE, &mut pages::STORE, &mut loader::STATE, &mut registry::STORE);

    let mut maintenance = timeout.pending or cancelled or domains::STORE.dead > 0 or pages::STORE.backings.pool.retiredCount > 0;

        let reaped = lifecycle::reapNext(&mut domains::STORE, &mut pages::STORE, &mut budgets::STORE, &mut interrupts::STORE);

        let reclaimed = frames::reclaim(&mut pages::STORE.backings.pool, 256);

        let after = now(HARTS[id].timer);

        let interval = HARTS[id].maintenance;

    }

    arm(HARTS[id].timer, deadline);

    sync::leave(guard);

}

/// Signal an initialized online hart while request metadata is serialized.

/// Fixed event metadata. Callers serialize all kernel-side mutations.

export record Store: Copy {

    /// Terminal events retained for publication into receiver rings.

    pending: u32,

    /// Producer metadata indexed by receiver domain.

    queues: [Queue; limits::DOMAINS],

    /// Terminal storage indexed by the terminating domain.

    terminals: [Terminal; limits::DOMAINS],

}

fn next(value: u32) -> u32 { return ((value as u64 + 1) & 0xffffffff) as u32; }

/// Initialize metadata before any queue or terminal record exists.

export fn initialize(store: &mut Store) {

    set store.pending = 0;

    for i in 0..limits::DOMAINS {

        set store.queues[i].generation = 0;

        set store.terminals[i].state = State::Free;

    }

}

            let terminal = &mut store.terminals[subject.index];

            assert terminal.subject == subject

                and terminal.receiver == receiver

                and terminal.state == State::Queued;

            set terminal.state = State::Acknowledged;

        }

        set queue.head = next(queue.head);

    }

}

    if terminal.state <> State::Pending { return false; }

    try refresh(store, terminal.receiver, ring);

    let queue = &mut store.queues[terminal.receiver.index];

    if distance(queue.tail, queue.head) == CAPACITY { return false; }

    set store.terminals[subject.index].state = State::Queued;

    assert store.pending > 0;

    set store.pending -= 1;

    publish(queue, ring, terminal.event, subject);

    return true;

}

        let terminal = store.terminals[i];

        if terminal.state <> State::Pending and terminal.state <> State::Queued { continue; }

        let receiver = terminal.receiver;

        if generations[receiver.index] == receiver.generation {

            if store.terminals[i].state == State::Pending { assert store.pending > 0; set store.pending -= 1; }

            set store.terminals[i].state = State::Acknowledged;

        }

    }

}

    if try! domains::retireContext(store, &mut memory.backings.pool, owner) { return true; }

    try! domains::retireStorage(store, &mut memory.backings, owner);

    return true;

}

export unsafe fn service(store: &mut domains::Store, windows: &budgets::Store, now: u64) -> u32 {

    let mut notified: [bool; limits::DOMAINS] = [false; limits::DOMAINS];

    let mut changed = false;

    for i in 0..limits::DOMAINS {

        let terminal = store.events.terminals[i];

        let mut receiver = try domains::get(store, terminal.receiver) catch { continue; };

        if receiver.state == domains::Lifecycle::Dead { continue; }

        let delivered = try events::deliver(&mut store.events, terminal.subject, &mut receiver.memory.ring) catch { false };

        if delivered { set notified[terminal.receiver.index] = true; set changed = true; }

    }

    if not changed { return 0; }

    for i in 0..limits::CONTEXTS {

use kernel::remote;

use kernel::pages;

use kernel::backing;

use kernel::capability;

use kernel::frames;

/// Receiver generations, contexts, and terminal events.

unsafe static STORE: domains::Store = undefined;

/// CPU authority retained by receivers.

unsafe static WINDOWS: budgets::Store = undefined;

/// Queued calls and acknowledgements retained by stopped contexts.

unsafe static REQUESTS: remote::Store = undefined;

/// Physical allocation metadata used for interrupted page calls.

unsafe static MEMORY: pages::Store = undefined;

/// Mapped frames available to interrupted page calls.

static RAM: [u64; 4096] = [0; 4096];

/// Reservations retained across private initialization.

unsafe static CALLS: lifecycle::Calls = undefined;

/// Shared queue storage for the first receiver.

    retain(4, 0);

    assert lifecycle::service(&mut STORE, &WINDOWS, 100) == 0;

    assert STORE.events.terminals[4].state == events::State::Queued;

}

/// Full receivers retain terminal events while other receivers make progress.

@test unsafe fn saturation() throws (testing::TestError) {

    initialize();

    let receiver = abi::Ref { index: 0, generation: 1 };

    for i in 0..events::ORDINARY {

    assert STORE.events.queues[0].tail == events::CAPACITY + 1;

    retain(4, 0);

    assert STORE.events.pending == 1;

    try! events::close(&mut STORE.events, receiver);

    assert STORE.events.pending == 0;

}