threads(M4): futex_wait/futex_wake, the blocking primitive

New private syscalls futex_wait(addr, expected, timeout_ns)=40 and
futex_wake(addr, count)=41. A waiter is a .blocked task tagged with
Task.futex_addr (no queue linkage); futex_wait reads the user word under the big
lock and parks only if it still equals expected, so a concurrent wake can't slip
between the check and the block. futex_wake scans the task table and readies up
to count waiters in the same address space. A timed wait also sets wake_at so the
existing wakeExpired times it out; futex_addr staying non-zero (only futex_wake
clears it) distinguishes timeout from a real wake. Waiters park in-kernel, so an
idle core still halts (no busy-wait).

runtime.Thread.Futex mirrors std.Thread.Futex (wait/timedWait/wake). thread-test
gains a futex mode: a waiter parks, the main thread wakes it (serial order
waiting/waking/woke, asserted by the case regex), and timedWait reports a
timeout.

Gate thread-futex PASS (3x); 18 guardrail cases green incl. sleep/event/ipc
blocking paths; build + host tests clean.

docs/threading-plan.md

@@ -184,21 +184,32 @@ plus `aspace-refcount`/`thread-spawn`; `zig build` clean, `zig build test` green
 > race (the thread *machinery* avoids the heap, but worker code sharing an allocator does
 > not). Both fold into the M5 `Mutex`/allocator work.
 
-## M4 — Futex: the one blocking primitive
+## M4 — Futex: the one blocking primitive ✅
 
-- [ ] [abi.zig](../system/abi.zig): `futex_wait = 40`, `futex_wake = 41`. Kernel
-      wait-queue keyed by `(aspace_root, vaddr)`; `futex_wait(addr, expected, timeout)`
-      parks the task iff `*addr == expected` (re-checked under the lock) and returns on
-      wake or timeout; `futex_wake(addr, count)` moves up to `count` waiters back to
-      ready. No spinning — a parked waiter leaves its core free to `hlt`.
-- [ ] `runtime.Thread.Futex` (`wait` / `timedWait` / `wake`) over the wrappers.
-- [ ] `-Dtest-case=thread-futex`: thread A prints `waiting`, `futex_wait`s on a word;
-      thread B sets the word and `futex_wake`s; A prints `woke`. Serial order
-      `waiting → waking → woke` proves the kernel handoff (not a spin). A second check
-      confirms `timedWait` returns `error.Timeout` when nobody wakes it.
+- [x] [abi.zig](../system/abi.zig): `futex_wait = 40`, `futex_wake = 41`. A waiter is a
+      `.blocked` task tagged with `Task.futex_addr` (no queue linkage);
+      `futex_wait(addr, expected, timeout_ns)` reads the user word under the big lock,
+      parks iff `*addr == expected`, and returns on wake or timeout; `futex_wake(addr,
+      count)` scans the task table and readies up to `count` matching waiters (same
+      address space). No spinning — a parked waiter leaves its core free to `hlt`. A
+      timed wait also sets `wake_at`, so the timer's `wakeExpired` wakes it; `futex_addr`
+      staying non-zero (only `futex_wake` clears it) is how the waiter tells timeout from
+      a real wake.
+- [x] `runtime.Thread.Futex` (`wait` / `timedWait` / `wake`) over the syscall wrappers.
+- [x] `-Dtest-case=thread-futex` (`smp: 4`): a waiter thread prints `waiting` and
+      `futex_wait`s on a word; the main thread publishes it, prints `waking`, and
+      `futex_wake`s; the waiter prints `woke`. Then a `timedWait` on an unwoken word
+      reports `error.Timeout`.
 
-**Gate:** `python3 test/qemu_test.py thread-futex` logs `thread: futex handoff ordered
-ok` and `thread: futex timeout ok`; guardrail set green.
+**Gate (met):** `python3 test/qemu_test.py thread-futex` passes, robust across 3 runs —
+the case's **ordered** regex asserts `waiting → waking → woke → PASS` on the serial
+stream (the handoff proof), and `thread-futex: timeout ok` confirms the timeout.
+Guardrail 18/18 green (incl. `sleep`/`event`/`ipc` blocking paths) + `aspace-refcount`,
+`thread-spawn`, `thread-join`; `zig build` clean, `zig build test` green.
+
+> **Note:** the kernel test checks only the freshest verdict marker via `bufferHas` (the
+> in-memory log ring buffer evicts older lines); ordering is asserted against the full
+> serial stream by the qemu regex instead.
 
 ## M5 — `Mutex` + `Condition` + `Semaphore`