Crowdedness Evidence

Who occupies each candidate area, with venues and links. Verified 26 August 2026 against 2024–2026 proceedings and preprints. This is the evidence behind the tiering in 01-candidate-topics.md.

Ratings: open = no serious occupant; active = published work exists but room remains; crowded = the obvious contribution is taken, and competing requires resources or novelty you probably do not have.

Every rating replaced an earlier estimate made from memory, and all twelve moved in the same direction — more crowded than guessed. Usually by one level, twice by two. Treat any unverified crowding claim, anywhere, as a lower bound.

A second pass on the same day covered three further areas; its evidence is in 04-new-candidates.md and its raw reports in reports/. Two rows below were revised as a result, and both moved in the usual direction.

---

Learned thread placement via sched_ext — active

No peer-reviewed conference paper on learned sched_ext placement surfaced in 2024–2026. The occupation is production engineering, not literature, which is why "beat EEVDF" is worthless and "beat scx_lavd" is the real bar.

• Improved load balancing with machine learning — LWN, Aug 2025 (Ching-Chun Huang, OSS-NA 2025). LWN · slides. A scx_rusty-derived scheduler trains a user-space model, ships it via a BPF map, and beats EEVDF by 10% on kernel compile with 77% fewer migrations. This is the obvious MVP, already built.
• sched_ext upstream overview — LWN. Meta's 16-hidden-unit network predicting CPU yield gave 15% nginx throughput at 87% accuracy; in-scheduling-path learning is a settled feasibility question.
• scx_lavd — production on Steam Deck (Valve/Igalia), being adopted as Meta's default fleet scheduler. docs · Phoronix. Already builds per-LLC, per-core-type, per-NUMA domains with an energy model and core compaction.
• Evolving sched_ext — OSPM 2026. LWN · Igalia slides. Capacity- and frequency-invariant load metrics make P-, E-, and LP-E-core loads directly comparable — the hard part of the problem, hand-solved.
• scx_p2dq, scx_pandemonium — in-tree at github.com/sched-ext/scx. p2dq is the energy-aware big.LITTLE recommendation; pandemonium already classifies tasks by wakeup frequency, context-switch rate, runtime, and sleep pattern, adapting online.
• Towards Agentic OS (SchedCP) — arXiv 2509.01245. Synthesizes BPF schedulers automatically; 2.11× p99 on schbench.

Sandbox policy for agent-generated code — active

Automated policy generation from observed behaviour is a product category. All of it assumes a stationary workload, and that assumption is the gap.

• Sandlock: Confining AI Agent Code with Unprivileged Linux Primitives — arXiv 2605.26298. Landlock for static filesystem/port rules, seccomp-bpf for unconditional denials, seccomp user notification for runtime-dependent decisions. ~5ms startup overhead, 44× faster than Docker. The substrate to build on, not compete with.
• Santa: Language Agnostic Automated System Call Policy Learning for Cloud Microservices — DIMVA 2026. PDF. Learns syscall policies on the fly and treats a new syscall as malicious. The closest baseline to the naive version of the idea — and killing the workload is exactly the wrong response for an agent.
• sandprint — GitHub. Generates seccomp profiles from eBPF-observed syscalls. Its README concedes the shared assumption outright: the profile reflects only the profiling run, so treat it as "a tightening, not a verification."
• Kubernetes Security Profiles Operator and commercial equivalents (ARMO, kguardian) — the productized state of the art.
• MAC and LSM stacking for AI agent runtimes — Zylos. Practical grounding on composing Landlock, seccomp, BPF LSM, and AppArmor on kernel 6.12+.

Agent rollback — closed as of the second pass

Revised 26 August 2026, second pass. The exception below — effects outside the sandbox — is claimed:

Externalization Barriers: An OS Abstraction for Untrusted Agent Exploration. Jinhao Hu, Bardia Mohammadi (MPI-SWS), Ashvin Goel (University of Toronto), Laurent Bindschaedler (MPI-SWS). AgenticOS @ SOSP 2026, 29 September 2026. program.

Title only; the PDF is not public until the workshop runs. The same group presents The Irreversibility Budget: Fleet-Level Risk Accounting and Admission Control for Agent Operating Systems, which takes the other novel reframing here — admission control priced on irreversible-action risk rather than on resources. Bindschaedler gives the keynote.

Independently, the Fork, Explore, Commit slides (Wang and Zheng, AgenticOS @ ASPLOS 2026, arXiv 2602.08199, code at multikernel/branchfs) name "external side effects (network, IPC) not rolled back" as their explicit limitation. Two groups converged on this boundary as the next thing.

Local rollback went from open to settled in roughly six months. Every system below states that it cannot undo effects outside the sandbox.

• Toward Systems Foundations for Agentic Exploration — arXiv 2510.05556. Position paper naming three open challenges: fork semantics, external side-effects, and native forking. Read this first.
• DeltaBox: Millisecond-Level Sandbox Checkpoint/Rollback — arXiv 2605.22781. ~10.8ms checkpoint hidden inside the inference window, ~1.86ms template-fork restore; SWE-bench MCTS state overhead from 23–48% down to 1–2%. The strongest baseline.
• Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes — arXiv 2604.28138. Infers per-turn what state is recovery-relevant; recovery correctness 8% → 100% on repair workloads.
• TClone: Low-Latency Forking of Live GUI Environments — arXiv 2605.17320. Adds selective commit and merge across branches — merge is where irreversibility bites hardest.
• AgentRewind: Recoverable Execution for Long-Horizon LLM Agents — arXiv 2608.14380. States plainly that network requests and external-service calls cannot be undone, and works around it by not re-triggering them. That workaround is the opening.

Threat to novelty: the compensating-transactions literature (sagas, workflow recovery, exactly-once semantics, the outbox pattern) has addressed undoing committed effects since the late 1980s. Search that vocabulary before committing.

GPU fair-share — crowded (compute), gap survives (cache capacity)

• Fairness in Serving Large Language Models (VTC) — OSDI 2024. USENIX. Token-granularity fair queueing with a proven 2× service-difference bound. Meters tokens, not cache.
• Orion: Interference-aware, Fine-grained GPU Sharing — EuroSys 2024. PDF. Per-operator interference-aware scheduling at tens-of-microseconds granularity.
• REEF: Microsecond-scale Preemption for Concurrent GPU DNN Inference — OSDI 2022. PDF. Kills the "GPUs cannot preempt" premise. Do not build an argument on it.
• USHER: Holistic Interference Avoidance — OSDI 2024. PDF.
• Bullet: Dynamic Spatial-Temporal Orchestration — ASPLOS 2026. DOI. SM masking via libsmctrl plus MPS; current single-device state of the art.
• Preprints and production, venue unverified: DLPM (arXiv 2501.14312), Roomie (arXiv 2607.16784), semi-PD (arXiv 2504.19867), Cohere's production DRR (blog), and kvwarden (GitHub) — which reports the per-tenant cache visibility limitation in vLLM that defines the surviving gap.

LLM-guided kernel fuzzing — crowded

• KernelGPT — ASPLOS 2025. PDF. LLM-synthesized syzlang specs; 24 bugs, 11 CVEs, specs merged upstream. Charges 192 CPU-hours of fuzzing and nothing for inference.
• SyzGPT: Unlocking Low Frequency Syscalls with Dependency-Based RAG — ISSTA 2025. DOI. Exactly the "reach code the grammar rarely does" framing: +17.7% coverage, +58% low-frequency-syscall coverage against seven fuzzers.
• KnitFuzz — CODASPY 2026. PDF. +19.4% blocks over syzkaller/Healer/Moonshine. Ten runs across four fuzzers on a 475 GB host — the statistical power you cannot match.
• Patch-to-PoC / K-REPRO — arXiv 2602.07287. LLM agents reproduce >50% of 100 KernelCTF bugs.
• Crash deduplication is separately taken: GPTrace (DOI) and ECHO (DOI).

Prefill/decode disaggregation — crowded

• DistServe — OSDI 2024. USENIX. Establishes the whole framing, including TTFT/TPOT-driven placement.
• Splitwise — ISCA 2024. MSR. Phase-specific heterogeneous hardware pools.
• Mooncake — FAST 2025, Best Paper. USENIX. Disaggregation at production scale with SLO-driven global scheduling.
• Libra — NSDI 2026. PDF. Neither colocated nor disaggregated wins; splits requests at token boundaries.
• JITServe — NSDI 2026. PDF. SLO-aware admission under length uncertainty.
• Vidur — MLSys 2024. arXiv. Profiling-calibrated discrete-event simulator at <9% latency error. Better than the 15% target the obvious MVP proposed.
• Revisiting Disaggregated LLM Serving for Performance and Energy Implications — EuroSys 2026. IBM. Finds the benefit is not guaranteed and depends on load and KV transfer medium. This is the surviving gap.

Tiered memory — crowded

• PACT: A Criticality-First Design for Tiered Memory — ASPLOS 2026. PDF. Access frequency is the wrong signal; per-page stall criticality gives up to 61% over the best of seven tiering systems with 50× fewer migrations.
• ITME: Inference Tiered Memory Expansion with Disaggregated CXL-Hybrid Memories — arXiv 2606.12556. Explicitly claims weight/prefix-KV determinism as its key insight. Validated on SK hynix CMM plus FPGA.
• HybridGen — arXiv 2604.18529. Semantic-aware K-in-DRAM / V-in-CXL placement beats page interleaving, gap widening with model size.
• Memtis — SOSP 2023. PDF — and TPP — ASPLOS 2023, arXiv. The mandatory baselines; TPP has been in mainline since 5.18.
• Analysis of Memory Access Patterns for Large Language Model Inference — MS thesis, Virginia Tech, 2025. PDF. The obvious MVP, already defended: same tool, same NUMA emulation, same baseline.
• Demystifying CXL Memory with Genuine CXL-Ready Systems and Devices — PDF. Argues emulation differences are large enough to compel revisiting prior conclusions. Reviewers will cite this at you.

Serverless cold start — crowded

• gCROP: On-demand and Parallel Checkpoint/Restore for GPU Applications — SoCC 2024. DOI. Sub-100ms startup for a 3.1 GB GPT-2-Large via parallel restore, profile-guided page-fault ordering, and multi-checkpoint deduplication. This is the target number and the storage-cost question, both answered.
• CRIUgpu: Transparent Checkpointing of GPU-Accelerated Workloads — arXiv 2502.16631. Merged upstream, released in CRIU 4.0. Conference venue unconfirmed.
• Medusa: Accelerating Serverless LLM Inference with Materialization — ASPLOS 2025. PDF. Lists multi-GPU as future work.
• ServerlessLLM — OSDI 2024. USENIX. The loading-path baseline.
• HydraServe — NSDI 2026 (arXiv 2502.15524). USENIX.
• CRIU-LZ4 — EuroMLSys 2026. PDF. 46–59% lower cold start.
• NVIDIA Dynamo Snapshot — blog. 21× startup reduction on gpt-oss-120b, single-GPU only. GPU state checkpointing is now vendor tooling — cuda-checkpoint + CRIU 4.0 + Dynamo. Reimplementing the mechanism has no contribution left.

Learned cache replacement — crowded

• 3L-Cache: Low Overhead and Precise Learning based Eviction Policy — FAST 2025. PDF. Twelve policies across 4,855 traces with CPU overhead measured relative to LRU; finds LRB costs up to 172× LRU. This is the accounting study, already published.
• Learning-Augmented Heuristics (S4-FIFO) — OSDI 2026. USENIX. Keeps ML off the data path; beats 3L-Cache by 8% at heuristic-level throughput. The critique has been made and resolved against learned policies.
• SIEVE is Simpler than LRU — NSDI 2024. PDF. 1,559 traces; a non-learned policy matches or beats learned ones.
• A New Formulation of Neural Data Prefetching (T-LITE) — ISCA 2024. PDF. Quantifies Voyager's infeasibility: 988× latency and 10.8× storage reductions needed.
• GL-Cache — FAST 2023. PDF.
• The page-cache slice is nearly untouched: only LearnedCache (arXiv 2605.26168), preliminary, FIFO baseline only.

KV-cache eviction and offload — crowded, hardware-gated

• DirectKV: No Buffer, No Bottleneck — OSDI 2026. USENIX. Zero-copy offload over NVLink-C2C on GH200/GB200; −50% transfer volume, −43% GPU memory.
• OrbitFlow — VLDB vol. 19. PDF. Online ILP solver for per-layer KV placement; +62%/+66% SLO attainment, −38% p95.
• KVDrive — arXiv 2605.18071. Holistic GPU/DRAM/SSD multi-tier management.

Power-capped inference — crowded

• throttLL'eM — HPCA 2025. arXiv. 43.8% energy cut under SLO.
• DynamoLLM — HPCA 2025. MSR. 53% energy saved.
• VoltanaLLM — ISC High Performance 2026. arXiv. Establishes the U-shaped energy-frequency curve.
• PALS — arXiv 2605.21427. Power cap as a first-class knob jointly with batch size and tensor parallelism; publishes the HW-only/SW-only/joint Pareto comparison. This is the obvious MVP, line for line.
• PowerSlider — arXiv 2608.21719. Time-varying caps — the last unclaimed framing.
• Consumer-GPU energy work exists (arXiv 2608.00008, arXiv 2608.01250) but publishes as measurement studies, not systems papers.

LLM-synthesized eBPF — crowded

• KEN: Kernel Extensions using Natural Language — arXiv 2312.05531, later published as Kgent, eBPF '24 (ACM SIGCOMM workshop) — DOI · code. LLM synthesis plus LLM-generated Hoare annotations plus symbolic execution (SeaHorn/Z3) with feedback loops; 80% correct, 2.67× over a GPT-4 baseline. Released the eBPFNLDataset corpus.

The seam: synthesis and comprehension come from the same model, so their errors may correlate and the verification may not be sound. That is a PL question, not an OS one.

---

The agent lane acquired a conference — the structural finding of the second pass

Worth its own section, because it explains why the agent-lane ratings above moved and it is the most important thing to re-check before you commit to anything in that lane.

AgenticOS, the Workshop on OS Design for AI Agents, has now run twice in six months: co-located with ASPLOS 2026 on 23 March in Pittsburgh (program with full PDFs) and with SOSP 2026 on 29 September in Prague (program). Neither has formal proceedings — both FAQs state that acceptance does not preclude later publication — so nothing there legally closes a venue. It does something more consequential for a student: it tells you which well-resourced groups are working which problem right now. The recurring names are MPI-SWS (Bindschaedler), UC Santa Cruz with Virginia Tech (Zheng, Quinn, Dan Williams, the eunomia-bpf group), and SJTU IPADS.

Between the two programs, five of six agent-workload areas checked in the second pass are covered by name. Claimed titles you should recognize before proposing anything adjacent: Externalization Barriers; The Irreversibility Budget; Isolation in the Age of Agents (Anjali and Swift, Wisconsin); AgentProf: Semantic Profiling for AI Agents; When Agent Context Goes Stale: Incoherence in Volatile Agent Context (HKU — a cache-coherence framing applied to agent context versus the filesystem it describes, and the most elegant OS framing on either program); Preserving GPU Profiling Accuracy under Concurrent GPU-Coding Agent Workloads (SJTU IPADS, and single-GPU-reachable, so specifically gone); Agate: Capability Microkernels as a Natural Substrate for AI Agents (Huawei); Securing Agentic AI with OS-Level Intent-Driven Capabilities (Oracle Labs and INESC-ID). The SOSP entries are titles only until the workshop runs.

Two consequences for how you use this file. First, the "spend a deliberate afternoon trying to kill your own idea" step from guide/01-scoping.md now has an obvious first stop for anything in the agent lane: read both programs. Second, there is an upside — this is a realistic venue for a masters student, it solicits position papers and experience reports, and per guide/01-scoping.md's advice on being scooped, planting a flag there early is worth more than it looks for a topic with a short shelf life.

Refereed anchors in the agent lane are few, which is itself a signal about the area's maturity: Murakkab (OSDI '26), one EuroSys 2026 paper on declarative OS interfaces for computer-use agents, and the older systems literature. Nearly everything else is a 2026 preprint.

Areas closed by the second pass

Beyond the twelve above. Full detail and the surviving cracks are in 04-new-candidates.md.

Ratings marked open* rest only on absence of search hits. Given this file's own finding that every prior estimate moved toward more crowded, treat them as lower bounds.

---

Verification caveats

Carried over from the underlying reports in reports/, and worth repeating to your advisor.

A meaningful share of 2026 citations are unrefereed preprints whose peer-review status could not be confirmed: Scorpio, DLPM, Roomie, Cascade, semi-PD, ITME, HybridGen, TraCT, Beluga, PALS, PowerSlider, LearnedCache, K-REPRO, CRIUgpu's venue, and HydraServe's NSDI page. Cite the published version where one exists, per guide/02-reading-system.md.

Absence of search hits is weak evidence, not proof. The sched_ext finding in particular rests on there being no relevant paper under submission, which nobody can verify. If that topic becomes your choice, treat being scooped as a live risk and follow the mitigation in guide/01-scoping.md: make the contribution an insight or mechanism rather than a leaderboard position.