> This is simple, but it allows one busy-looping high-priority process
> kill the whole system, which is unacceptable, of course.  Something
> like this + a safeguard system maybe..? :)

If you have a safeguard system to prevent a high-priority process from
eating the CPU, you're no longer hard real-time, unless you've got
some very sophisticated notion which allows the scheduler to
distinguish when a high-priority process is spinning its wheels
instead of doing useful work..