Topic selectiontopic-selection/03-reading-list

Reading List for the Live Options

Scoped to the Tier 1 topics in 01-candidate-topics.md, plus the two shortlisted options in proposals/. Verified 26 August 2026.

The root README declines to ship a bibliography because a stale one is worse than none. That caution holds — this list is a snapshot for topic selection, not the related-work bibliography for your thesis. Build that one yourself in Zotero as guide/02-reading-system.md describes, and expect a third of the 2026 preprints here to have moved to a venue or been superseded by the time you cite them.

Read for limitations, not mechanisms

You are not surveying the field. You are hunting for the sentence where an author says what their system cannot do, because in every one of these areas the mechanism work is finished and the disclaimed limitation is the only place a masters thesis still fits.

Budget two days, not two weeks. First-pass everything per Keshav's method (guide/02-reading-system.md), second-pass only the four or five bearing on your top candidate, and write a templates/paper-note.md note in the same session — filling the "what they did not do" field is the entire point of this exercise.

Read first, regardless of topic

Toward Systems Foundations for Agentic Exploration — arXiv 2510.05556. link

A position paper that names open problems instead of solving one, which makes it the cheapest possible orientation. It identifies three challenges — fork semantics, external side-effects, and native forking. Ask: which of the three did the 2026 systems close, and which is still open? The answer is the shape of the agent-lane opportunity. Second-pass note: by August 2026 the answer is that the 2026 systems closed fork semantics and native forking, and external side-effects is claimed by Externalization Barriers at AgenticOS @ SOSP 2026. Read it for orientation, not for an opening.

Proposal A — memory-hierarchy citizenship

Five items, and unusually for this list, two of them are not papers. That changes how you read: for the upstream code you cannot cite a limitations section, so you must measure the incumbent yourself and quote its commit message.

Accelerating Model Loading in LLM Inference by Programmable Page Cache (MAIO/PPC) — USENIX FAST '26. PDF

The paper you must distinguish yourself from, and read it first because it may kill the topic for you. Ask: what exactly does Burn-after-Reading optimize, and does the evaluation report any metric belonging to a process other than the loader? If it does, stop.

Rethinking I/O Caching for LLM Inference on Resource-Constrained Mobile Platforms — Kim, Lee, Bahn, Mathematics 13(22):3689, 2025. DOI

Refereed but a low-prestige non-systems venue, so treat its priority claim as real and its prestige as low. Ask: their access decomposition — one-time init scans, persistent hot sets, looped weight accesses — does it hold on a desktop, and does anything in their cache-sizing guidance account for a co-resident non-LLM workload?

An Efficient Context Management System for On-Device LLMaaS (Libra) — Yin, Xu, Li, Liu, SenSys 2026. DOI

The most dangerous paper for this proposal, because its Observation #3 is the same argument on Android. Ask: what exactly does LMKD mis-price, and is it the same quantity oom_badness() mis-prices? The answer is no — Libra is about recomputation cost of KV context, yours is about reclamation cost of weights — but you must be able to say that in one sentence without notes.

mm: BPF OOM (v3) — Roman Gushchin, January 2026. LWN 1056177, and read the patch series, not just the summary.

Your mechanism. Ask: what information is available inside bpf_handle_out_of_memory(), and can a BPF program actually distinguish clean file-backed pages from anonymous ones at decision time? If it cannot, your policy is unimplementable and you need to know in week one.

Debunking zswap and zram myths — Chris Down, March 2026, plus the LWN discussion — and mm: Reduce direct reclaim stalls with RAM-backed swap — Matt Fleming, LWN 1061060

Read the LWN comment threads, not only the articles. Shakeel Butt's statement of the MM community's position — conservative in-kernel killer, aggressiveness punted to userspace — is the assumption your thesis attacks, and a quotable statement of an incumbent's premise is worth more than a paper. Ask: what workload is that position calibrated on, and does the calibration transfer to a single-user laptop?

Then read against yourself. The idea-killing afternoon for this topic is not a literature search, it is an experiment: memory.low on a victim, memory.high on the loader, POSIX_FADV_DONTNEED after load. Do it in week two.

Proposal B — collapse creep

Almost entirely mailing-list reading, which is unusual and slow. Budget for it as related work rather than background.

khugepaged: mTHP support, v17 — LKML · LWN summary

Read the cover letter and then as much of the review discussion as you can stand. Ask: where exactly is collapse creep described, what alternatives to restricting max_ptes_none were proposed on the list, and why were they rejected? Anything you propose that was already rejected there is dead on arrival.

xHeap: Transparent Hugepage Optimizations for Memory Offloading — CHEOPS '26. PDF

The general form of your critique, already made with a working kernel module. Ask: is their "promotions lack responsiveness and concurrency" claim the same claim as yours, or a different one? If it is the same, you are writing xHeap for a different workload.

Temeraire: Beyond malloc efficiency — Hunter et al., OSDI '21. PDF

Read this because it will be cited at you as evidence the hugepage-policy space is worked out. Ask: what decision does Temeraire actually make, and is it the same decision khugepaged makes? It is not — Temeraire is an allocator, khugepaged is a background promoter — and you need that distinction ready.

Ingens and HawkEye — the other two names a reviewer will produce. First-pass only; you need to know what they claim, not how they work.

Large-folio readahead for exec memory, v7 — Usama Arif, June 2026. LWN 1064021 · LWN 1066175

Not a competitor, but the adjacent infrastructure. Ask: does this series' machinery for pressure-adaptive large folios on read-only file mappings generalize to your case, and if so, is generalizing it a better thesis than a collapse predictor?

Then read against yourself. Search hugepage promotion prediction, page promotion policy, and the forward citation graphs of Temeraire and Ingens. The openness rating for this topic rests on absence of hits, so this search is not optional.

Agent rollback and external effects

Read all four for their limitations sections. The mechanisms are settled; you are looking for the state they admit they cannot restore.

DeltaBox: Millisecond-Level Sandbox Checkpoint/Rollback — arXiv 2605.22781. link The strongest baseline: ~10.8ms checkpoints hidden inside the inference window, ~1.86ms template-fork restore, SWE-bench MCTS state overhead from 23–48% down to 1–2%. Ask: what is left on the table?

Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes — arXiv 2604.28138. link Infers per-turn what state is recovery-relevant. Ask: how does it decide, and what classes of effect does that inference miss?

TClone: Low-Latency Forking of Live GUI Environments — arXiv 2605.17320. link Adds selective commit and merge across branches. Ask: how are merge conflicts handled? Merge is where irreversibility bites hardest.

AgentRewind: Recoverable Execution for Long-Horizon LLM Agents — arXiv 2608.14380. link States plainly that network requests and external-service calls cannot be undone, and works around it by not re-triggering them. Ask: what breaks when the external service has already changed? That question is the thesis.

Then read against yourself. Search the compensating-transactions literature — sagas, workflow recovery, exactly-once semantics, the outbox pattern — and decide honestly whether your contribution is distinguishable from it. This is the idea-killing afternoon from guide/01-scoping.md, and for this topic it is mandatory rather than optional.

Agent sandbox policy

Sandlock: Confining AI Agent Code with Unprivileged Linux Primitives — arXiv 2605.26298. link The substrate to build on, not compete with: Landlock for static rules, seccomp-bpf for hard denials, seccomp user notification for runtime-dependent decisions. Ask: where would a learned policy plug in?

Santa: Automated System Call Policy Learning for Cloud Microservices — DIMVA 2026. link The closest baseline to the naive version of the idea. Ask: what does it do when a genuinely new syscall appears — and why is killing the workload the wrong answer for an agent?

sandprint — link Its README states the shared assumption outright: the profile reflects only the profiling run, so treat it as a tightening rather than a verification. Quantify how badly that fails for agents and you have your measurement chapter.

MAC and LSM stacking for AI agent runtimes — link Not a citation — a build guide for composing Landlock, seccomp, BPF LSM, and AppArmor on kernel 6.12+.

sched_ext and learned placement

Mostly not papers. Your baseline here is production code, which is unusual and changes how you establish the gap: you cannot cite a limitations section, so you must measure the incumbent yourself.

Evolving sched_ext: Resource Control, Topology Awareness, Energy Efficiency — OSPM 2026. LWN · slides Capacity- and frequency-invariant load metrics make P-, E-, and LP-E-core loads comparable. Ask: what signal do these invariants throw away that a learned predictor could recover? Your whole thesis lives or dies on that answer.

Improved load balancing with machine learning — LWN, Aug 2025. LWN · slides Beats EEVDF by 10% with 77% fewer migrations. Ask: exactly which decision does the model make, and is core-type sensitivity among its features?

scx_lavd documentation — link, and the source of scx_p2dq and scx_pandemonium at github.com/sched-ext/scx Read the code, not a paper. Ask: what does pandemonium's online task classification already capture? If it captures your features, you have no thesis.

sched_ext upstream overview — LWN Meta's yield-predicting network. Establishes that in-path learning is feasible, so feasibility is not your contribution.

Fairness in Serving Large Language Models (VTC) — OSDI 2024. link Your primary baseline and the paper you must distinguish yourself from. Ask: what exactly does its cost function meter, and construct the workload where that metric and cache occupancy diverge.

REEF: Microsecond-scale Preemption — OSDI 2022. link Read this so you do not repeat the dead claim that GPUs cannot preempt.

Orion — EuroSys 2024. link — and USHER — OSDI 2024. link The interference-characterization work. Ask: do they model memory capacity at all, or only compute and bandwidth?

Bullet — ASPLOS 2026. DOI Current single-device state of the art. Note its dependency on libsmctrl, an out-of-tree library — a plumbing cost you would inherit.

LLM kernel fuzzing, compute-normalized

KernelGPT — ASPLOS 2025. link Read the evaluation section with the accounting question in mind: 192 CPU-hours of fuzzing charged, nothing charged for inference. Work out what its inference budget converts to.

SyzGPT — ISSTA 2025. DOI Claims exactly the "reach code the grammar rarely does" result. Ask: against what compute budget?

KnitFuzz — CODASPY 2026. link Ten runs, four fuzzers, 475 GB host. Read this to calibrate what statistical power you cannot afford, then design an evaluation with fewer arms and a sharper claim.

3L-Cache — FAST 2025. link — and S4-FIFO — OSDI 2026. link Read these even though they are about caching, not fuzzing. They are the methodological template: this is what "charge the method for its own cost" looks like when done properly, and you are transplanting it to a field where nobody has.

Disaggregation on commodity interconnects

Revisiting Disaggregated LLM Serving for Performance and Energy Implications — EuroSys 2026. link The paper your gap comes from: the benefit is not guaranteed and depends on load and transfer medium. Ask: how far did they push the low-bandwidth case, and what did they leave unmeasured?

DistServe — OSDI 2024. link — and Libra — NSDI 2026. link DistServe establishes the framing; Libra already argues neither colocation nor disaggregation universally wins. Ask whether Libra's token-boundary splitting already subsumes your crossover controller — if it does, this topic is dead and better to know now.

Vidur — MLSys 2024. link Use it rather than writing a simulator. Ask: is its cost model valid in the PCIe-bound regime, or calibrated only on fast interconnects? If the latter, extending it is a contribution in itself.