New Candidate Topics

Thirteen additional topics and twelve fresh drops, from a second literature pass on 26 August 2026 covering three areas the original twelve did not reach: the memory and storage hierarchy for local inference, agents as an OS workload beyond sandboxing and rollback, and AI-for-systems outside the fashionable subsystems. Raw reports with full citations are in reports/.

Read 01-candidate-topics.md first — its three lanes, requirement scales and tiering conventions apply unchanged here, and its corrections notice matters, because this pass retired one of its Tier 1 entries.

What this pass found

The agent lane closed while the first pass was being written. A dedicated venue — AgenticOS, the Workshop on OS Design for AI Agents — ran co-located with ASPLOS 2026 in March (program) and runs again with SOSP 2026 on 29 September (program). Between them they cover, by name, five of the six agent-workload areas checked in this pass. Three well-resourced groups — MPI-SWS (Bindschaedler), UC Santa Cruz with Virginia Tech (Zheng, Quinn, Williams, the eunomia-bpf group), and SJTU IPADS — are systematically enumerating exactly the abstraction gaps a student would enumerate. Neither workshop has formal proceedings, so nothing is legally closed; what is closed is your head start.

The learned-policy-replaces-heuristic lane is substantially picked over. LAKE surveyed five kernel subsystems in 2023, KML did storage in 2023, Heimdall industrialized the block layer at EuroSys 2025, and S4-FIFO defeated the premise outright in caching at OSDI 2026. What survives is not "learn a policy" but "the hand-tuned controller in this specific subsystem has a conceded, documented failure mode."

The surviving opportunities have a new shape, distinct from the first pass. Where 01-candidate-topics.md found limitations stated in papers' limitations sections, this pass mostly found them stated in merged upstream code, documentation, and mailing-list threads. Clang's kernel context-analysis documentation says outright that it "does not infer context locks." khugepaged's mTHP series names collapse creep and disables the tunable rather than fix it. That is a better kind of gap in one way — nobody can dispute that the incumbent conceded it — and a worse kind in another: there is no citation, so you must measure the incumbent yourself, and a reviewer may say "that is a tuning problem" rather than a research problem.

---

Tier 1 — Live options

13. Local inference as a bad citizen of the memory hierarchy

Systems for AI, inverted · Compute 0 · Kernel 2 · ML 0 · 6 months · workshop to measurement conference · best fit for an eBPF-strong student

The question. Every system that touches the page cache for model loading optimizes the loader's objective: did the weights stay resident, did loading saturate the SSD. None reports what loading does to the browser, IDE and language server sharing that cache. And under pressure, oom_badness() charges clean, file-backed, read-only weight pages at the same weight as anonymous heap — so the process whose memory is cheapest to reclaim is the one the kernel is most eager to kill. What does local inference cost the machine it runs on, and can a policy that knows reclamation cost convert kills into graceful degradation?

Smallest defensible result. A victim-side characterization across the four loading modes llama.cpp now ships and the five swap configurations users actually run, plus a bpf_oom_ops policy that discounts reclaimable file-backed pages.

What you build on. Bare-metal Linux, 16 GB deliberately tight, NVMe, pinned kernel with Roman Gushchin's BPF OOM series (LWN 1056177, v3). Not a VM and not WSL2 — WSL2 produces no reclaim signal at all.

How it goes wrong. Your baseline is correctly configured cgroup v2 plus POSIX_FADV_DONTNEED, and if it closes the gap you have written a documentation page. Run it in week two. Distinguish yourself from Libra (SenSys 2026) in one sentence or you have no thesis. Shelf life is roughly a year.

Full proposal: proposals/A-memory-hierarchy-citizenship.md.

14. Collapse creep in khugepaged's mTHP support

AI for Systems · Compute 0 · Kernel 3 · ML 1 · 6–9 months · workshop

The question. The mTHP collapse series (LWN 1034426, v17) documents that above HPAGE_PMD_NR/2 a collapse installs enough non-zero pages that the next scan re-promotes the same region, ratcheting order upward forever. The maintainers restricted max_ptes_none to 0 or 511 rather than solve it. Can a predictor of collapse retention recover the benefit that restriction forgoes?

Smallest defensible result. Per-region collapse-history tracing quantifying churn at intermediate thresholds, then a cheap online per-order gate.

How it goes wrong. max_ptes_none=0 is free, so everything depends on showing it leaves real TLB benefit unclaimed — test that in Phase 1. Openness rests on absence of search hits. And this is core-MM development, which is a level deeper than eBPF.

Full proposal: proposals/B-khugepaged-collapse-creep.md.

15. LLM-inferred kernel locking and context annotations

AI for Systems · Compute 0 · Kernel 2 · ML 1 · 9 months · mid-tier · cheapest to execute

The question. Kernel documentation for compiler-based context analysis states the limitation outright: Clang's analysis "explicitly does not infer context locks acquired or released by inline functions. It requires explicit annotations." Sasha Levin's Kernel API Specification Framework, four RFC rounds in, has annotated eight functions — sys_open, sys_close, sys_read, sys_write, sys_madvise, sys_sched_setattr, mlock, execveat. Across forty million lines of C. What fraction of the kernel's synchronization discipline is mechanically recoverable, and at what cost per function?

Smallest defensible result. Inferred __must_hold/__acquires/context-class annotations for a bounded subsystem, validated against three free mechanical oracles — existing hand-written sparse and Clang annotations, lockdep runtime observations, and might_sleep()/might_fault() assertion sites — with precision and recall reported separately for correctness and completeness, plus dollars per function.

How it goes wrong. Three ways, and the first is the killer. Your baseline is lockdep, which already catches locking-discipline violations at runtime, for free, and has for twenty years; static annotation only helps on paths you never execute, so you must find and measure that residue, and it may be small. Second, never let the model grade its own output — that is the correlated-error seam that sank the Kgent option in Tier 3 of 01-candidate-topics.md; keep the oracle mechanical. Third and most important for you: the framing decides the department. Pitched as "can we recover the kernel's synchronization discipline mechanically, and what does that say about how much of the locking contract is implicit," it is an OS thesis. Pitched as "LLM specification inference with precision/recall tables," it is a programming languages thesis in the wrong building. Run the idea-killing search against specification mining, API protocol inference and typestate inference — this is Daikon's literature, from 1999, and it will not surface under kernel-flavoured queries.

Do not be confused by Kernel Contracts: A Specification Language for ML Kernel Correctness (arXiv 2604.22032) — that is about GPU compute kernels, a different sense of the word.

16. Attributing agent irreproducibility between the model and the environment

Agents · Compute 0 · Kernel 1 · ML 0 · 9 months · workshop

The question. Every agent replay system — agrepl, hetu, agentrr, rewind — intercepts at the LLM API boundary and assumes the environment re-executes faithfully. SWE-bench's own issue tracker says otherwise: eval containers created without TZ=UTC, PYTHONHASHSEED=0 or LANG=C.UTF-8 produce flaky results for identical patches at max_workers > 1 (issue #602). After pinning the model channel, what share of residual outcome variance is environmental, and does OS-level determinism collapse it?

Smallest defensible result. A recording LLM proxy composed with deterministic scheduling of the sandbox process tree, run over known-flaky SWE-bench Verified instances, producing one number: the environment's share of variance.

What you build on. Hermit (facebookexperimental/hermit), a deterministic Linux container over ptrace and seccomp — in maintenance mode — or a hand-rolled ptrace serialization layer. Plus rr and CRIU.

How it goes wrong. Severe engineering risk: Hermit breaks on complex syscalls and agent sandboxes are threads, network and sometimes Docker-in-Docker; its own docs warn that nested containers block namespaces, ptrace, seccomp and perf_event_open. The realistic failure is spending the whole thesis on compatibility. Design so the measurement stands even if the determinism half fails. On novelty, the ancestors are deep and an OS reviewer knows them cold — ReVirt (OSDI '02), ODR and PRES (SOSP '09), dOS (OSDI '10), DTHREADS (SOSP '11), and above all eidetic systems / Arnold (OSDI '14). Make the attribution result the claim, never the tool. Note that On Randomness in Agentic Evals (arXiv 2602.07150, 60,000 trajectories) explicitly leaves this open, which is your gap statement written for you.

17. Auditing stable-tree backport selection

AI for Systems · Compute 0 · Kernel 1 · ML 0 · 6 months · mid-tier · cheapest result in either pass, wrong department

The question. AUTOSEL (source, LWN) runs in production, generating AUTOSEL review series every merge window via embedding retrieval over historical commits. There is no published evaluation of it and no published precision or recall for stable-backport selection at all. Meanwhile the pain is documented in public: maintainers on the LWN thread asking for exposed reasoning and worrying about "excessive false positives burdening humans." Does embedding similarity to historically-backported commits actually predict what should be backported, and at what cost in false positives per accepted patch?

Smallest defensible result. Reproduce the selection over several historical merge windows and report precision, recall, false positives per true positive, and dollars per decision. Ground truth is free: what landed in stable is in git metadata, and Fixes: tags plus later reverts label both error directions.

How it goes wrong. Your baseline is embarrassing — Fixes: tag presence plus a keyword list plus a diff-size threshold may match an LLM at a millionth of the cost, and if it does, your thesis is a two-page note. Label noise is real: "should have been backported" is a maintainer judgement, and Levin's own tooling surfaced patches he had previously missed, so your ground truth is partly generated by the system you are auditing. And it reads as software engineering, unambiguously — no OS mechanism, no kernel code, no resource-management decision. Viable only if your advisor sits across OS and SE.

---

Tier 2 — Narrow or contested survivors

18. Writeback throttling and dirty-page balancing

Compute 0 · Kernel 3 · weakest evidence in either pass

Wu Fengguang's 2011 dirty-ratelimit controller is still the design in mm/page-writeback.c fifteen years on, and still being patched for regressions in 2026 — a stable thread records fuse buffered writes collapsing from 1400 MiB/s to 2000 KiB/s under a strictlimit and memcg interaction. The assumption worth attacking: that writeback bandwidth is estimable from a 200 ms trailing window and shared fairly across N symmetric dirtiers. No learned or LLM work on balance_dirty_pages() surfaced at all — but that is absence of hits in a subsystem where the relevant prior work might be one unindexed LKML thread, so distrust it. The tuning framing is separately taken by SemaTune/TuxBot (arXiv 2605.15026, preprint, 41 Linux knobs), which usefully scopes itself out of fast-path controllers — telling you the fast path is where anything is left, and also that it is the hardest place to work. Writeback is where the kernel's worst user-visible latency bugs live; a negative result is very likely.

19. Read-set-keyed caching of agent tool calls

Compute 0 · Kernel 2 · ML 0

TVCache (arXiv 2602.10986, preprint) keys a tool-value cache on longest-prefix match over a tool-call graph. That is conservative: two branches of an agent search tree that issue different command sequences but read the same inputs cannot hit. Keying on the eBPF-observed read-set would. Then a reviewer says one word: Riker (Curtsinger et al., USENIX ATC '22), always-correct language-agnostic incremental builds via syscall-traced fine-grained dependencies — precisely this insight. Behind it, Vesta, Bazel/Skyframe, Memoize, Fabricate, Rattle, CDE (ATC '11), and self-adjusting computation. The honest framing is "we port Riker's keying discipline to agent tool calls and measure the delta," which may suffice for an MSc and will not suffice for a systems venue.

20. Page sharing and density for near-clone agent sandboxes

Compute 0 · Kernel 1 · ML 0

Agent sandboxes are near-identical at t=0 — same base image, toolchain, node_modules — and diverge monotonically. Every published density lever treats their memory as opaque anonymous pages and reaches for swap: GKE's high-density agent sandbox guide publishes a full runtime matrix (runc 200 pods/node with swap, gVisor 160, kata-clh 50, kata-qemu 20) with vm.swappiness=100 as the tuning. No KSM pages_sharing numbers for agent sandboxes exist publicly. One-host study, 128 GB workstation. But it is a 2009 mechanism on a 2026 workload, one Google blog post from being scooped, and AgentENV already reports 9.6× overcommit via ballooning in production — a bar you cannot clear on one box. Reviewer vocabulary: KSM, ballooning (Waldspurger, OSDI '02), Difference Engine (OSDI '08), Satori.

21. Content-addressability of agent-issued environment setup

Compute 0 · Kernel 1 · ML 0

Provisioning dominates agent wall-clock — AgentCgroup (arXiv 2602.09345) puts OS-level execution at 55–74% of end-to-end latency — and prewarming is taken by SpecBox (arXiv 2607.23933), which speculates on streaming tokens over a learned Sandbox Dependency Graph. What survives: SpecBox assumes sandbox identity is predictable from history, which fails in the SetupBench regime (arXiv 2507.09063) where the agent bootstraps an environment it has never seen. Nobody has asked whether agent-issued install commands are content-addressable at all — agents type pip install X ad hoc rather than resolving a lockfile, so the cache key is unstable in a way Dockerfile-issued commands are not. Measure the achievable ceiling of a cross-run CAS. Reviewer says: Vesta, Riker, Nix content-addressed derivations, ccache. And AgentENV ships the whole stack in production, so "we built it" is unavailable — only "we measured it."

22. Accounting audit of LLM-for-kernel-maintenance tooling

Compute 0 · Kernel 1 · ML 0

This is 01-candidate-topics.md #5 generalized one field wider, and the asymmetry noted there holds again. PortGPT reports 89.15% backport success and no cost per patch. LinuxFL+ says "minimal costs" with no figure and no compute-normalized comparison. AUTOSEL publishes nothing quantitative. KNighter (SOSP 2025) is the only system in the area treating inference cost as first-class, and only operationally. Meanwhile the metric that decides adoption — false positives per accepted suggestion — is unpublished everywhere. Same caveats as #5: you must be willing to publish a critique, and you cannot match the field's statistical power. Mandatory reading before committing to anything in this file: GenAI for Systems: Recurring Challenges and Design Principles from Software to Silicon (arXiv 2602.15241), 275+ papers across eleven application areas. Use it as an idea-killer.

23. Flake-robust test prioritization for kernel CI

Compute 0 · Kernel 1 · ML 1

An empirical study of test case prioritization on the Linux Kernel (ASE 2025 journal-first) evaluated 17 techniques and found that more than half lose 29.9–63.5% of their fault-detection ability to flaky tests, and that none models flakiness. That is a gap named by the incumbent. It is also a small delta on a completed study whose authors are positioned to do it next, similarity-based prioritization is nearly free as a baseline, and the whole thing reads as software engineering with thirty years of standardized metrics behind it.

24. Performance-regression bisection under a noisy oracle

Compute 0 · Kernel 1 · ML 0

Every LLM-assisted kernel localization system targets crashes and panics — LinuxFLBench (ACL 2026), kAPR (IST 2026), kAgent, Time Travel (arXiv 2511.18854). None targets throughput or latency regressions, where the bisect predicate is a noisy continuous measurement and a commit diff carries no signal about a 3% throughput change. Characterize how badly bisection degrades, then allocate measurement budget adaptively. Verify before committing: Intel's LKP / 0-Day CI does automated kernel performance-regression bisection with statistical repetition in production, and if its methodology is published anywhere your contribution evaporates. Reviewer says: "this is sequential analysis under a noisy oracle, a solved problem — where is the systems contribution?"

25. GTT-backed weight residency versus host reclaim on unified-memory APUs

Compute 1 · Kernel 2 · ML 0 · hardware-gated

AMD's ROCm guidance states that GTT allocations are dynamic and "not permanently reserved, allowing the operating system to reclaim memory when the GPU isn't actively using it." That reclaim path has no published characterization under a process holding tens of gigabytes of GTT-backed weights for its lifetime while a desktop competes for the same physical pages — and community evidence is that the outcome is an OOM kill, not reclaim. Requires a Strix Halo or Ryzen AI Max class machine with 64–128 GB unified memory; a discrete-GPU laptop cannot substitute, and if you do not own one the area is closed. The dominant failure is writing a benchmark report — several already exist with better hardware coverage and continuous maintenance.

---

Tier 3 — Recommend dropping

Twelve more, with the citation that kills each, so you can defend the decision in one sentence.

Two traps in the 2026 title space

Worth recognizing on sight, because they make areas look crowded when they are not, and they waste search time.

"LLM × OS" is saturated with work that never touches a kernel. The Missing Memory Hierarchy: Demand Paging for LLM Context Windows (arXiv 2603.09023) applies Denning's working-set language to token context management through an API proxy — no kernel, no pages. IsotopeOS is a Rust wrapper around llama-cpp-2. AIOS is agent orchestration. Symphony (HotOS 2025) is real work but borrows OS abstractions for a serving system rather than changing an OS.

Unrefereed preprints that state your premise verbatim are a specific hazard. STAP (Zenodo, Jan 2026) claims semantic tensor-aware paging with a 7.5× P99 improvement; it has zero citations and its authors have no publication record. You cannot evaluate it and you cannot ignore it. Cite such work, state its status plainly, note that no reproducible evidence accompanies the claim, and move on. The same applies to arXiv:2607.16200 (agrepl), whose "proof of determinism" is a restatement of its construction, and to anything hosted on clawxiv.org, which could not be confirmed to exist.

Verification caveats

Three ratings in this file rest only on absence of search hits, which this repository has already established is weak evidence that moves in one direction: learned writeback throttling (#18), khugepaged collapse-decision learning (#14), and the absence of any published AUTOSEL evaluation (#17). Treat all three as lower bounds on crowdedness.

A large share of the 2026 citations here are unrefereed preprints whose peer-review status could not be confirmed. Every one is flagged inline where it appears; the reports in reports/ carry the same flags in more detail. Cite the published version where one exists, per guide/02-reading-system.md.

The AgenticOS @ SOSP 2026 papers are titles only — the workshop is a month out and PDFs are not posted. They tell you what has been claimed, not how well. Re-check that program before committing to anything in the agent lane.