Kernel: a kill never waits on its victim — the last thread out tears its process down

issues/design-debt/toyos-abi-decodes-only-the-roster-header-not-its-entries.md

@@ -0,0 +1,32 @@
+---
+status: open
+kind: defect
+opened: 2026-09-28
+---
+
+# `toyos-abi` decodes only the roster header, not its entries
+
+`SysinfoHeader::decode` (`toyos-abi/src/syscall.rs:85`) is "the one spelling of
+the header's offsets, so a reader takes a field rather than an index" — but
+that one spelling stops at the header. `SYSINFO_ENTRY_SIZE`
+(`toyos-abi/src/syscall.rs:103`) documents the entry's byte layout in prose
+only, and every reader of an entry hand-spells its offsets instead of calling
+a decoder:
+
+- `tests/toyos-rust-tests/src/bin/kill_ends_every_wait.rs:140-141` —
+  `entry[9] == 0`, `entry[8]`.
+- `tests/toyos-rust-tests/src/bin/process_lifecycle.rs:258` —
+  `buf[pos + 9] != 0, buf[pos + 8]`.
+- `tests/toyos-rust-tests/src/bin/abuse_thread_name.rs:62` — `entry[9]`.
+- `userland/toybox/src/ps.rs:64-65` — `buf[pos + 8]`, `buf[pos + 9] != 0`.
+
+Four readers, each free to walk off by a field the way the header's own doc
+comment warns against. `kernel/src/syscall/machine.rs:309-310` is the one
+writer (`entry[8] = state; entry[9] = is_thread;`), so the four are already
+one silent renumbering away from reading the wrong column.
+
+**Exit**: a `SysinfoEntry::decode` (or equivalent) in `toyos-abi`, the four
+readers above converted to call it, and no roster-entry offset left
+hand-spelled outside that one function.
+
+Owner: `toyos-abi/src/syscall.rs`, whoever next touches the roster ABI.

issues/diagnostics/the-quiesce-last-staging-dies-on-ten-seconds-of-guest-clock.md

@@ -0,0 +1,19 @@
+---
+status: open
+kind: tooling
+opened: 2026-09-28
+---
+
+# The `quiesce-last-*` staging dies on ten seconds of guest clock
+
+`kernel/src/quiesce.rs`'s `last::STAGED` is a 10 s in-guest deadline. `hold`
+panics the boot when the stop has not counted the held thread alone within it,
+and `await_the_held_thread` panics when no thread named `quiesce-last` has
+reached its syscall within it. `quiesce-last-park` and
+`quiesce-last-teardown` all rest on it, and `quiesce_twice`'s `WAITS_WITHIN` is
+priced inside it. A QEMU test's only clock is the harness's ceiling: a guest
+slower than the deadline dies with a staging panic that names no defect.
+
+Owner: orchestrator. Exit condition: both sides of the staging wait on the
+other's event with no deadline, and a staging that never arrives is the
+harness's ceiling.

issues/kernel/a-killed-shutdown-caller-panics-on-its-second-drain-backoff.md

@@ -0,0 +1,22 @@
+---
+status: open
+kind: defect
+opened: 2026-09-27
+---
+
+# A killed shutdown caller panics on its second drain backoff
+
+`writeback::drain_all` (`kernel/src/writeback.rs`) retries a refused drain
+through `block::between_attempts`, whose park is cancellable, and discards what
+it answers. A thread whose kill bit is set gets `Cancelled` from that park at
+once, retries, and parks again; `TaskHandle::take_cancel` asserts on the second
+cancel reported to one thread, so the kernel panics. `ops::until_answered`
+reads the kill bit before it parks and does not have this; `drain_all` does not.
+
+The caller is the shutdown syscall (`syscall/machine.rs`), which a kill posted
+before `quiesce::stop` can still reach, and it takes a second backoff only when
+the device refuses two drain attempts on budget. Not reproduced.
+
+Exit condition: `drain_all`'s retry either stops parking once its caller is
+killed or parks uncancellably, with a test that kills a caller parked in a
+refused drain.

issues/kernel/deferred-release-outlives-its-syscall.md

@@ -196,12 +196,6 @@ at all.** It belongs with that track, not beside it.
 
 ### What "give the batch an owner" costs, worked out 2026-08-20
 
-An owner has to be the *thread*, not the CPU. `kill_process` phase 2 calls
-`scheduler::retire_task`, which parks the killer until the victim's record is
-released, so the killing thread can be moved to another CPU between the
-`close_all` that queues its objects and the syscall exit that would drain them —
-a per-CPU list would strand exactly the batch it was added to own.
-
 A per-thread list cannot live behind `ThreadData`'s lock either:
 `teardown_resources` holds `ProcessData` across `close_all`, and its own first
 line is that the two locks are never held together. So the list has to be on the

issues/kernel/quiesce-wakes-on-the-last-park-gave-up-on-one-thread-beside-the-held-one.md

@@ -17,6 +17,10 @@ FAIL quiesce_wakes_on_the_last_park: the stop gave up on 2 thread(s) that never
 - PR #555 at `d2656765`.
 - PR #559 at `ac948e6a`.
 
+`quiesce_wakes_on_the_last_teardown`'s boot shares the same shape, in the Fast
+tier: PR #549 at `751e36d9`, `4 of 6 … 2010 ms of a 2010 ms budget over 2
+sweep(s)`. That boot normally counts 5 userland threads.
+
 The earliest is PR #510 at `98e803cb`, recorded in
 `issues/build/quiesce-wakes-on-the-last-park-lost-its-serial-ready-beside-other-guests.md`:
 `stop: 4 of 7 userland thread(s) stopped ... in 2010 ms of a 2010 ms budget`.
@@ -49,7 +53,10 @@ enabled test checks any of these:
 - that a band, a park or an exit wakes the stop, rather than its deadline;
 - `in_flight == 0` with `begun > 0`;
 - the thread census;
-- the `console-queue-at-the-stop` drain.
+- the `console-queue-at-the-stop` drain;
+- that the stop waits for a teardown in flight —
+  `quiesce_wakes_on_the_last_teardown`'s only claim, and the only enabled
+  guest check of it, disabled by this same issue.
 
 `quiesce_refuses_a_second_shutdown` stays green over a lost post. It judges the
 stop only by `stopped_the_machine`, so a stop that spends its budget and then
@@ -60,7 +67,9 @@ finds everything stopped passes it.
 - an instrument that names each thread still running when the stop gives up,
   with its name, tid, cpu and scheduler state;
 - the mechanism it names fixed;
-- this test green in a Fast tier beside other guests;
+- this test green beside other guests;
+- `quiesce_wakes_on_the_last_teardown` — the stop waits for a teardown in
+  flight — green beside other guests;
 - an enabled guest test checking each claim listed above.
 
 Owner: the stop path, `kernel/src/quiesce.rs`; held by the orchestrator.

issues/kernel/scheduler-pass-blocks-in-xhci.md

@@ -23,20 +23,15 @@ sits on the wrong side of the boundary the budget describes.
 What a CPU inside that recovery holds is *every message addressed to it*: an
 `Adopt` carrying a task, a `Wake` for a parked thread, a `Retire`. Nothing in the
 scheduler can shorten it — every reap and every wake is bounded by the owning
-CPU's pass latency by design, which is exactly why the design is sound. The one
-thing in the tree that notices is `scheduler::retire_task`'s 1 s guard, and it
-notices by panicking:
+CPU's pass latency by design, which is exactly why the design is sound.
 
 ```
 retire_task: task not released after 1s: InTransit(CpuId(1))
 ```
 
 That panic fired on the owner's T14 at 949.792 s of uptime with doom exiting. The
 *balance*-path half of it is fixed: `hand_off` reaps a killed task rather than
-handing it on, gated by simulator invariant I14. This half is not,
-and it would produce the same panic with `Blocked(CpuId(n))` in the message
-instead — the guard cannot tell a lost message from a busy CPU, which is what it
-is written as if it could.
+handing it on, gated by simulator invariant I14. This half is not.
 
 The second instance of the same shape used to be the idle loop's log flush;
 the idle loop touches no filesystem now — the log is logd's file — and the
@@ -48,7 +43,7 @@ that `drain_irqs` only ever does work it can finish: drain the event ring,
 dispatch HID reports, note that a port or an endpoint owes work. The debounce and
 the port reset were already moved off this path for exactly this reason (CLAUDE.md,
 USB hotplug); the control transfers inside `configure` and `recover_endpoints`
-were not. Until then, `retire_task`'s bound is measuring the USB bus.
+were not.
 
 **And the budget cannot see it.** `cpu::MAX_PASS_NS` is measured against by
 `SchedPass::finish`, from the `now` the pass was entered with to the end of

issues/kernel/the-lock-spins-shootdown-poll-says-if-is-clear-and-two-callers-spin-with-it-set.md

@@ -0,0 +1,22 @@
+---
+status: open
+kind: defect
+opened: 2026-09-28
+---
+
+# The lock spin's shootdown poll says `IF` is clear, and two of its callers spin with it set
+
+`Lock::lock` (`kernel/src/sync.rs`) polls TLB shootdowns inside its spin with the
+comment "this spin runs with `IF` clear". Two callers spin there with `IF` set:
+
+- a kernel thread, which `kernel_start` (`arch/x86_64/entry.rs`) enters with `sti`;
+- the idle loop, whose `reap_finished` takes `PROCESS_TABLE.lock()`.
+
+There the 0xFE IPI can land inside `tlb::poll`'s own `serve_if_owed`, so one
+CPU runs a serve nested inside another. `Shootdown::serve` raises `flushed` with
+`fetch_max` for exactly that case, and `kernel-loom`'s
+`a_nested_serve_is_not_undone_by_the_one_it_interrupted` reds when it stores.
+The comment gives the poll a reason that holds only for syscall context.
+
+**Exit**: the comment states when the spin runs with `IF` set and when clear, and
+why the poll is needed in each.

kernel-loom/tests/tlb_shootdown.rs

@@ -234,3 +234,33 @@ fn an_initiator_answers_while_it_waits() {
         assert!(s.wait_turn(0, 1, g0, || {}));
     });
 }
+
+/// A serve that an interrupt nests inside another publishes the later
+/// generation, and the outer serve, finishing after it, must not take it back.
+///
+/// The nested serve runs on a thread of its own, so loom places it at every
+/// point of the outer one, the nesting among them. Reds when `serve` stores
+/// what it owes instead of raising to it.
+#[test]
+fn a_nested_serve_is_not_undone_by_the_one_it_interrupted() {
+    model(|| {
+        let s = Arc::new(Shootdown::new());
+        let first = s.issue();
+        let nested = {
+            let s = Arc::clone(&s);
+            loom::thread::spawn(move || {
+                let later = s.issue();
+                s.serve(1, || {});
+                later
+            })
+        };
+        s.serve(1, || {});
+        let later = nested.join().unwrap();
+        assert!(s.served(1, first));
+        assert!(
+            s.served(1, later),
+            "cpu 1 flushed for the nested shootdown, and the serve it interrupted \
+             published an older generation over it",
+        );
+    });
+}

kernel/src/actuator.rs

@@ -119,6 +119,9 @@ actuators! {
     /// Hold the thread named `toyos_quiesce::LAST_THREAD` inside `SYS_NANOSLEEP`, and the shutdown until it is held there, until the stop waits on it alone: its park is then the stop's last transition.
     quiesce_last_park = "quiesce-last-park";
 
+    /// The same for the last thread out of its process, between its leaving and its teardown: that teardown is then the stop's last transition.
+    quiesce_last_teardown = "quiesce-last-teardown";
+
     /// Refuse the second directory-entry write of the file `writeback_durability` stages for the retry gate — the first is that file's own seed being made durable — as a budget expiry, so a flush fails at its metadata write with its pages already written and settled.
     fat_flush_meta_refuse = "fat-flush-meta-refuse";
 
@@ -524,7 +527,7 @@ actuators! {
     /// Judged by `partition_claim_gives_up`.
     partclaim_root_withheld = "partclaim-root-withheld";
 
-    /// Reopen init by pid once it is spawned, the way `SYS_PROCESS_OPEN` does.
+    /// Reopen init by pid once it is spawned, and open every kernel thread's pid, the way `SYS_PROCESS_OPEN` does.
     process_reopen_selftest = "process-reopen-selftest";
 
     /// Offer the block layer a second device claiming a registered `DeviceId`, and report what it did with it.

kernel/src/arch/x86_64/hw.rs

@@ -466,12 +466,8 @@ impl Hw for KernelHw {
     }
 
     /// Reached once per task, from a later pass running on another stack, so dropping `payload`
-    /// here never frees the stack this call stands on; `publish_released` must be last — a
-    /// retirer's wait ends only once this drop has happened.
+    /// here never frees the stack this call stands on.
     fn release(&self, _key: TaskKey, payload: KernelPayload, acct: TaskAccounting) {
-        let handle = payload.handle.clone();
-        handle.finalize(acct);
-        drop(payload);
-        handle.publish_released();
+        payload.handle.finalize(acct);
     }
 }

kernel/src/main.rs

@@ -656,6 +656,12 @@ pub(crate) unsafe extern "C" fn kernel_main(kernel_args: &KernelArgs) -> ! {
     log::console::start();
     iod::start();
 
+    // Here: the last kernel thread is spawned.
+    #[cfg(feature = "boot-actuators")]
+    if actuator::process_reopen_selftest() {
+        sched::kthread::open_selftest();
+    }
+
     smp::set_ready();
 
     // After the release, because a shootdown waits on CPUs that are not