Scheduler stage 3: job fairness, with per-CPU two-level EEVDF and creation authority

build/kernelkeys.rs

@@ -43,11 +43,6 @@ pub struct Declared {
 
 /// Every hashed container in `kernel/src`, with the origin of its keys.
 pub const DECLARED: &[Declared] = &[
-    Declared {
-        file: "kernel/src/scheduler.rs",
-        ty: "HashMap<Pid, Arc<KShare>>",
-        keys: "`process::Pid`, minted by the process table",
-    },
     Declared {
         file: "kernel/src/process.rs",
         ty: "HashMap<Pid, ProcessEntry>",

images/system.toml

@@ -79,13 +79,15 @@ receives = ["power"]
 # `screen`. `volume` is soundserver's master level and mute, which the volume
 # keys set and no other row receives. The display is a virtio-gpu function the
 # compositor drives, where the machine has one, and the firmware's framebuffer
-# otherwise.
+# otherwise. `jobs` makes each program it starts a job of its own, with its own
+# share of the CPU.
 [programs.compositor]
 service = true
 serves = ["compositor", "prompt", "clipboard", "input", "display"]
 receives = ["soundserver", "filepicker", "volume"]
 devices = ["pci:03:80:00/1af4:1050", "framebuffer"]
 starts = ["terminal", "files", "/apps"]
+syscap = ["jobs"]
 login = true
 
 # The i8042, driven from userland: its ports and its two lines are this

issues/a-woken-thread-waits-out-a-sibling-spinners-quantum-when-every-cpu-is-busy.md

@@ -7,8 +7,8 @@ opened: 2026-10-12
 # A woken thread waits out a sibling spinner's quantum when every CPU is busy
 
 With every CPU running a spinner of the woken thread's own process, a wake that
-lands where it cannot be forwarded and cuts nothing waits for the pick, and the
-pick serves the fair band's frozen insertion-time keys: a queued sibling whose
+lands where it cannot be forwarded and cuts nothing waited for the pick, and the
+pick served the fair band's frozen insertion-time keys: a queued sibling whose
 key went stale when it was queued sits below the woken thread's, and two
 threads of one process tie at the running one's. With the busy-CPU wake change
 (PR #874) the PR's metal scout found phase 2's pair together on one CPU on both
@@ -32,9 +32,10 @@ there is not in the logs. One boot per tree each:
 The logs: [first judgement](https://github.com/ToyOSOrg/evidence/tree/cfb4aa7c18348380fcb873e99809db20cf18af22/metal/judgement),
 [second](https://github.com/ToyOSOrg/evidence/tree/d63b878f86d09c3aefcad27fd30eb3485fa81e5b/r2/metal/judgement).
 
-Owned by stage S4 of the scheduler design (#872), per-thread EEVDF, which
-deletes the frozen insertion keys: the orchestrator's application of the
-owner's ruling (#885) on PR #874 files it there.
+The frozen insertion keys and the protected run are gone: each CPU runs EEVDF
+over its job groups and their threads (`kernel/pure/sched/queue.rs`), and a
+wake due first cuts the running request at its minimum run, `MIN_SLICE_NS`
+(250 µs). What remains is the measurement.
 
 **Before #874**, the scout behind it (`wt/toyos-scout-sys` at `fbb958b17`,
 https://github.com/ToyOSOrg/ToyOS/pull/866#issuecomment-6119438569) timed a
@@ -44,10 +45,9 @@ max 6.69 ms; on the AMD bench p50 ≤2.62 ms, p99 ≤7.86 ms, max 7.55 ms. With
 core idle, such a wake is the fair band's pick to decide. In EEVDF (Stoica et
 al., "A Proportional Share Resource Allocation Algorithm for Real-Time,
 Time-Shared Systems", RTSS 1996) a task woken inside a quantum is picked no
-sooner than the next quantum's start, and a wake's quantum here is the
-protected run, `PROTECTED_RUN_NS` (1 ms).
+sooner than the next quantum's start.
 
-**Exit**: S4's re-run of K1–K4 on both benches, which reads phases 2, 3 and 5
+**Exit**: a re-run of K1–K4 on both benches, which reads phases 2, 3 and 5
 against the base numbers above; and a metal row on the T14 and the AMD bench
-with eight CPU-bound threads on eight CPUs that holds a woken task to run within
-one protected run and reports its p99.
+with eight CPU-bound threads on eight CPUs that holds a woken task due first
+to run within one minimum run and reports its p99.

issues/clippy-stage-two-is-lints-one-at-a-time.md

@@ -128,7 +128,7 @@ before adopting:
 
 | lint | count | what was measured, and what it does not see |
 |---|---:|---|
-| `significant_drop_in_scrutinee` | 6, 1 a defect | Silent in the gate: it reports only a guard marked `#[clippy::has_significant_drop]`, and no kernel guard is. With `sync::LockGuard` alone marked, the kernel under `x86_64-unknown-none` with default features reported 6 sites, and 5 once `sys_chdir` stopped holding the VFS guard into `process_data` — the one defect. The 5 left (`arch/x86_64/idt/mod.rs`'s `for` over `IDT.lock()`, `loader/mod.rs`'s `/system/lib` fallback, `user_ptr::translate_user`, `sys_readdir`, `sys_dlopen`) take no second lock under the guard, and adopting the lint rewrites each. Unmeasured: AArch64, the actuator and instrument shapes, and the guards the measurement did not mark (`SleepGuard`, `block`'s `Locked`, the serial guard). It cannot join `ADOPTED`, which `build/clippy.rs` splices into the host workspace's shapes too, where std's `MutexGuard` is already marked: it would be a per-shape `-W`, as `undocumented_unsafe_blocks` is. **It sees one spelling, not the order**: an `if let Some(x) = L.lock().as_mut()` whose value borrows from the guard is in the tree and in neither report (`file_cache::touch`, `scheduler::remove_vruntime`, `inbox`'s `answer`), and so is any inversion through a named guard, the common shape. |
+| `significant_drop_in_scrutinee` | 6, 1 a defect | Silent in the gate: it reports only a guard marked `#[clippy::has_significant_drop]`, and no kernel guard is. With `sync::LockGuard` alone marked, the kernel under `x86_64-unknown-none` with default features reported 6 sites, and 5 once `sys_chdir` stopped holding the VFS guard into `process_data` — the one defect. The 5 left (`arch/x86_64/idt/mod.rs`'s `for` over `IDT.lock()`, `loader/mod.rs`'s `/system/lib` fallback, `user_ptr::translate_user`, `sys_readdir`, `sys_dlopen`) take no second lock under the guard, and adopting the lint rewrites each. Unmeasured: AArch64, the actuator and instrument shapes, and the guards the measurement did not mark (`SleepGuard`, `block`'s `Locked`, the serial guard). It cannot join `ADOPTED`, which `build/clippy.rs` splices into the host workspace's shapes too, where std's `MutexGuard` is already marked: it would be a per-shape `-W`, as `undocumented_unsafe_blocks` is. **It sees one spelling, not the order**: an `if let Some(x) = L.lock().as_mut()` whose value borrows from the guard is in the tree and in neither report (`file_cache::touch`, `inbox`'s `answer`), and so is any inversion through a named guard, the common shape. |
 
 ## `undocumented_unsafe_blocks`, per area
 

issues/guest-tests-a-loaded-host-can-turn-red.md

@@ -16,9 +16,8 @@ measurement owed. The one observed red of this shape, `virtio_sound_counts`, is
   halted or reset within 2 s.
 - `kill_ends_every_wait` (`kill_ends_every_wait.rs`, `HELD` 1 s): a kill that takes more than 1 s
   of starved wall time to land reads as "the child outlived" it. A timing claim.
-- `sched_stress` (`sched_stress.rs`): the post-wake vruntime lag held to ±50 ms after a 10 ms
-  sleep, where vCPU time the host takes is charged as the thread's runtime. Its connect-storm pace
-  is `issues/timing-verdicts-ruled-off-qemu-have-no-metal-arm.md`'s.
+- `sched_stress` (`sched_stress.rs`): its connect-storm pace is
+  `issues/timing-verdicts-ruled-off-qemu-have-no-metal-arm.md`'s.
 - `abuse_thread_table` (`abuse_thread_table.rs`, `RUN_BOUND` 10 s): each thread runs within 10 s.
 - `netstack_socket_churn` (`netstack_socket_churn.rs`, `LET_GO` 20 s), `netstack_streams` and
   `netstack_streams_e1000e` (`netstack_streams.rs`, `WOKEN` 60 s, and the harness's 30 s

issues/no-row-holds-a-wake-beside-seven-spinners-to-100-us.md

@@ -11,10 +11,10 @@ could take it. PR #874 (`347e3313d`) changed that. An ordinary wake's doorbell
 now kicks a busy target on its edge (`Doorbell::ring`,
 `kernel/pure/sched/mailbox.rs`), and at the drain `place`
 (`kernel/pure/sched/cpu.rs`) forwards a fair task that would queue behind a
-running fair task to an idle CPU. A task that stays with a strictly lower key
-cuts the running task's quantum to end `PROTECTED_RUN_NS` (1 ms) after its
-dispatch, and one queued task counts as surplus to a steal
-(`PUSH_THRESHOLD` = 1).
+running fair task to an idle CPU. A task that stays and is due first cuts the
+running request at its minimum run, `MIN_SLICE_NS` (250 µs) after its dispatch
+(`kernel/pure/sched/queue.rs`), and one queued task counts as surplus to a
+steal (`PUSH_THRESHOLD` = 1).
 
 **What #874 measured.** The metal row `wake_onto_busy` (`tests/toyos.rs`)
 times a wake onto a CPU that one spinner holds, beside CPUs with nothing to

issues/per-cpu-scheduler-and-pmm-state-shares-lines-every-cpu-writes.md

@@ -20,8 +20,9 @@ every other CPU writes too:
   so two CPUs' handles share a line. Each pass stores its own `load`, `surplus` and `last_pass`
   (`cpu.rs:1669-1672`), and every wake does a read-modify-write on its
   target's doorbell (`kernel/pure/sched/mailbox.rs:475`).
-- **`Frontier`.** One global `AtomicU64`, `fetch_max`ed on every pick
-  (`kernel/pure/sched/fair.rs:44-46`, called at `cpu.rs:1827`).
+- **A job's runnable count.** One `AtomicU32` per job
+  (`kernel/pure/sched/job.rs`), changed by each CPU its threads enter or
+  leave a fair band on, and read at each of those CPUs' decisions.
 
 **Measured on the T14** (`wt/toyos-scout-clock` at `fa6a2a829`, the
 `internet_download` row's twelve download windows over two boots;