Add process management: enumerate, supervisor-gated kill, exit notifications

process_enumerate snapshots the task table (the device_enumerate shape, so
ps is a user program); system_spawn returns the child id, records the caller
as supervisor, and takes an exit endpoint; process_kill is allowed only for
the supervisor. Every death — exit, fault, or kill — posts a child-exit badge
to that endpoint (the IRQ-as-IPC pattern as SIGCHLD). A target caught off-CPU
is reaped in place; a running one is condemned and finished at its next
system call or tick, guarded so teardown never lands mid-kernel-operation.
Tested by process-list, process-kill, and supervision (a ring-3 supervisor
exercising the whole surface); design notes in docs/process-management.md.

system/kernel/ipc-synchronous.zig

@@ -47,6 +47,8 @@ pub const ENOENT: i64 = 4; // no such registered service
 pub const ENOSPC: i64 = 5; // handle table or registry full
 pub const ENOMEM: i64 = 6; // out of memory
 pub const EPEER: i64 = 7; // peer died before replying (its process exited or was killed)
+pub const ESRCH: i64 = 8; // no such process (process_kill of an unknown/dead id)
+pub const EPERM: i64 = 9; // not permitted (process_kill by anyone but the supervisor)
 
 /// A badge with this bit set is an asynchronous notification (e.g. an IRQ), not a
 /// message from a client — there is no reply owed. The low bits carry the source
@@ -93,6 +95,7 @@ pub fn dropRef(endpoint: *Endpoint) void {
 // --- sender FIFO (endpoint-local, via Task.next) ----------------------------
 
 fn enqueueSender(endpoint: *Endpoint, t: *Task) void {
+    t.ipc_wait_endpoint = @ptrCast(endpoint); // so a kill can unlink a parked caller
     t.next = null;
     if (endpoint.sender_tail) |tail| tail.next = t else endpoint.sender_head = t;
     endpoint.sender_tail = t;
@@ -102,10 +105,34 @@ fn dequeueSender(endpoint: *Endpoint) ?*Task {
     const t = endpoint.sender_head orelse return null;
     endpoint.sender_head = t.next;
     if (endpoint.sender_head == null) endpoint.sender_tail = null;
+    t.ipc_wait_endpoint = null;
     t.next = null;
     return t;
 }
 
+/// Unlink `t` from the sender FIFO it queues in, if any — the kill path for a
+/// client parked in `call` that no server has received yet. Without this, a dead
+/// caller would later be dequeued as a dangling pointer. The endpoint is still
+/// alive here: `t`'s own handle table holds a reference until closeHandles runs
+/// (which the kill path does *after* this). Precondition: the big kernel lock is
+/// held.
+pub fn abandonSenderLocked(t: *Task) void {
+    const endpoint: *Endpoint = @ptrCast(@alignCast(t.ipc_wait_endpoint orelse return));
+    t.ipc_wait_endpoint = null;
+    var previous: ?*Task = null;
+    var node = endpoint.sender_head;
+    while (node) |n| : ({
+        previous = n;
+        node = n.next;
+    }) {
+        if (n != t) continue;
+        if (previous) |p| p.next = t.next else endpoint.sender_head = t.next;
+        if (endpoint.sender_tail == t) endpoint.sender_tail = previous;
+        t.next = null;
+        return;
+    }
+}
+
 // --- cross-address-space copy ----------------------------------------------
 
 /// Copy `len` bytes from `source_va` in address space `source_as` to `destination_va` in

system/kernel/process.zig

@@ -129,9 +129,14 @@ pub fn setInitialRamdisk(image: []const u8) void {
 /// written back into the trap frame, since the entry paths restore user registers
 /// from it. One handler serves both the system_call/sysret and int-0x80 entry paths.
 ///
-/// Install it once at boot (before any user code runs) via `init`.
+/// Install it once at boot (before any user code runs) via `init`. Also registers
+/// the scheduler's kill hooks: the scheduler sits below this layer, so finishing a
+/// deferred process_kill (IRQ bindings, IPC handles, the exit notification) is
+/// called back up into here from the tick (see scheduler.reapKillPendingLocked).
 pub fn init() void {
     architecture.setSystemCallHandler(system_call);
+    scheduler.terminate_current_hook = terminateCurrentLocked;
+    scheduler.reap_task_hook = reapTaskLocked;
 }
 
 /// Return -1 (as an unsigned bit pattern) in the system_call result register.
@@ -140,6 +145,19 @@ fn fail(state: *architecture.CpuState) void {
 }
 
 fn system_call(state: *architecture.CpuState) void {
+    const t = scheduler.current();
+    const user = t.aspace != 0;
+    if (user) {
+        // A condemned process (process_kill caught it running) dies at its next
+        // kernel entry — before it can spawn, claim, or message anything else.
+        if (t.kill_pending) terminateCurrent();
+        // Mark the span of this call so the timer tick never tears the task down
+        // in the middle of a kernel operation (scheduler.reapKillPendingLocked).
+        t.in_system_call = true;
+    }
+    defer if (user) {
+        t.in_system_call = false;
+    };
     switch (@as(SystemCall, @enumFromInt(architecture.systemCallNumber(state)))) {
         .exit => {
             exit_code = architecture.systemCallArg(state, 0);
@@ -178,6 +196,8 @@ fn system_call(state: *architecture.CpuState) void {
         .io_read => systemIoRead(state),
         .io_write => systemIoWrite(state),
         .clock => systemClock(state),
+        .process_enumerate => systemProcessEnumerate(state),
+        .process_kill => systemProcessKill(state),
         _ => fail(state),
     }
 }
@@ -415,28 +435,40 @@ fn systemDeviceRegister(state: *architecture.CpuState) void {
     architecture.setSystemCallResult(state, id);
 }
 
-/// system_spawn(name_ptr, name_len, arguments_ptr, arguments_len) -> 0 on success,
-/// -1 on failure. Load the binary bundled in the initial-ramdisk under `name` as a
-/// fresh ring-3 process. `name` becomes the child's argv[0] (and its task name, so
-/// a fault report can say which binary died); `arguments` is an optional
-/// NUL-separated blob that becomes argv[1..] — how a supervisor parameterises what
-/// it starts ("you are the driver for device 12"). 0/0 means no extra arguments.
-/// This is the mechanism a user-space supervisor (the device manager) uses to start
-/// a driver it matched: discovery and policy stay in user space, the kernel only
-/// spawns.
+/// system_spawn(name_ptr, name_len, arguments_ptr, arguments_len, exit_endpoint)
+/// -> the child's process id on success, -1 on failure. Load the binary bundled in
+/// the initial-ramdisk under `name` as a fresh ring-3 process. `name` becomes the
+/// child's argv[0] (and its task name, so a fault report can say which binary
+/// died); `arguments` is an optional NUL-separated blob that becomes argv[1..] —
+/// how a supervisor parameterises what it starts ("you are the driver for device
+/// 12"). 0/0 means no extra arguments. This is the mechanism a user-space
+/// supervisor (the device manager) uses to start a driver it matched: discovery
+/// and policy stay in user space, the kernel only spawns.
 ///
-/// Ungated for now — any process may spawn any bundled binary. A capability (only a
-/// supervisor holds the right to spawn) belongs here once the model grows one; see
-/// docs/driver-model.md. Both buffers are bounds-checked into the user half exactly
-/// like `debug_write`, and an unknown name or a load failure returns -1.
+/// The caller is recorded as the child's **supervisor** — the sole holder of the
+/// right to `process_kill` it (docs/process-management.md). `exit_endpoint` (a
+/// handle, or `abi.no_cap` for none) names an endpoint of the caller's to notify
+/// when the child ends, any way it ends — the IRQ-as-IPC pattern reused as the
+/// microkernel's SIGCHLD.
+///
+/// Spawning itself is still ungated — any process may spawn any bundled binary; a
+/// spawn capability belongs here once the model grows one (docs/driver-model.md).
+/// Both buffers are bounds-checked into the user half exactly like `debug_write`,
+/// and an unknown name or a load failure returns -1.
 fn systemSpawn(state: *architecture.CpuState) void {
     const ptr = architecture.systemCallArg(state, 0);
     const len = architecture.systemCallArg(state, 1);
     const arguments_ptr = architecture.systemCallArg(state, 2);
     const arguments_len = architecture.systemCallArg(state, 3);
-    if (len == 0 or len > 64 or ptr >= user_half_end or ptr + len > user_half_end) return fail(state);
+    const exit_handle = architecture.systemCallArg(state, 4);
+    const t = scheduler.current();
+    if (len == 0 or len > scheduler.maximum_task_name or ptr >= user_half_end or ptr + len > user_half_end) return fail(state);
     if (arguments_len > maximum_argument_bytes) return fail(state);
     if (arguments_len != 0 and (arguments_ptr >= user_half_end or arguments_ptr + arguments_len > user_half_end)) return fail(state);
+    const exit_endpoint: ?*ipc.Endpoint = if (exit_handle == abi.no_cap)
+        null
+    else
+        ipc.resolveHandle(t, exit_handle) orelse return failErr(state, ipc.EBADF);
     const image = ramdisk_image orelse return fail(state);
     const rd = initial_ramdisk.Reader.init(image) orelse return fail(state);
 
@@ -458,19 +490,51 @@ fn systemSpawn(state: *architecture.CpuState) void {
     while (i < rd.count) : (i += 1) {
         const item = rd.entry(i) orelse continue;
         if (!std.mem.eql(u8, item.name, name)) continue;
-        spawnProcess(item.blob, 4, argv[0..argc]) catch return fail(state);
-        architecture.setSystemCallResult(state, 0);
+        const child = spawnProcessSupervised(item.blob, 4, argv[0..argc], t.id, exit_endpoint) catch return fail(state);
+        architecture.setSystemCallResult(state, child);
         return;
     }
     fail(state); // no bundled binary by that name
 }
 
+/// process_enumerate(buffer, maximum) -> total: snapshot the task table into the
+/// caller's buffer (up to `maximum` `abi.ProcessDescriptor` entries), returning
+/// the total live-task count — the exact shape of `device_enumerate`, so a `ps`
+/// is a user program over a snapshot, not a kernel service. Read-only and
+/// ungated: what is running is not a secret between cooperating bring-up
+/// processes.
+fn systemProcessEnumerate(state: *architecture.CpuState) void {
+    const buffer_ptr = architecture.systemCallArg(state, 0);
+    const maximum = architecture.systemCallArg(state, 1);
+    const t = scheduler.current();
+    if (t.aspace == 0 or buffer_ptr >= user_half_end) return fail(state);
+    const sz = @sizeOf(abi.ProcessDescriptor);
+    const cap = @min(maximum, (user_half_end - buffer_ptr) / sz); // clamp to the user half
+    const out: [*]abi.ProcessDescriptor = @ptrFromInt(buffer_ptr);
+    architecture.setSystemCallResult(state, scheduler.enumerate(out[0..@intCast(cap)]));
+}
+
+/// process_kill(id) -> 0 / -ESRCH / -EPERM: end the process `id`. Only its
+/// supervisor — the process that spawned it — may do so; the supervision link is
+/// the kill capability, so no user/permission model is needed and a stray id
+/// cannot be a weapon (ids are never reused, so a stale one just misses).
+fn systemProcessKill(state: *architecture.CpuState) void {
+    const t = scheduler.current();
+    if (t.aspace == 0) return fail(state);
+    const id = architecture.systemCallArg(state, 0);
+    if (id > std.math.maxInt(u32)) return failErr(state, ipc.ESRCH);
+    const r = killProcess(t.id, @intCast(id));
+    architecture.setSystemCallResult(state, @bitCast(r));
+}
+
 /// Processes killed by a CPU fault rather than a clean exit. Evidence for the
 /// fault-recovery test, and a health signal a supervisor can consult later.
 pub var fault_kill_count: u64 = 0;
 
-/// Tear down the current user process and reschedule; never returns. Shared by the
-/// exit system call and the fault path (`killCurrentProcess`). The order matters:
+/// Release everything a dying task holds and tell its supervisor — the shared
+/// half of every path out of a process: clean exit, fault kill, and process_kill
+/// (both the immediate reap and the deferred tick-time terminate). The order
+/// matters:
 /// - IRQ bindings are dropped before the handle table closes: dropping the last
 ///   endpoint reference destroys the Endpoint, and a still-bound GSI would have an
 ///   ISR call notifyFromIsr on freed memory the next time the device fired.
@@ -479,20 +543,84 @@ pub var fault_kill_count: u64 = 0;
 /// - A client this task still owes a reply to (it died between receive and reply)
 ///   is failed with -EPEER rather than left blocked forever — a dead server must
 ///   not hang its callers.
-pub fn terminateCurrent() noreturn {
-    const t = scheduler.current();
-    {
-        const flags = sync.enter();
-        defer sync.leave(flags);
-        irq.releaseOwner(t.id);
-        if (t.ipc_client) |client| {
-            t.ipc_client = null;
-            client.ipc_status = -ipc.EPEER;
-            scheduler.readyLocked(client); // its blocked `call` now returns the error
-        }
-        ipc.closeHandles(t);
+/// - The task is unlinked from wherever IPC parked it (an endpoint's sender FIFO,
+///   a receive wait queue, or a server's owed-reply slot) *before* the handles
+///   close, so nothing ever dequeues a dangling pointer. These are no-ops for a
+///   running task ending itself; they matter when process_kill reaps a blocked one.
+/// - The exit notification is posted last, once the process can no longer act, so
+///   a supervisor that receives it observes a fully-released child. The endpoint
+///   reference taken at spawn is dropped with it.
+/// Precondition: the big kernel lock is held.
+fn releaseTaskResourcesLocked(t: *scheduler.Task) void {
+    irq.releaseOwner(t.id);
+    if (t.ipc_client) |client| {
+        t.ipc_client = null;
+        client.ipc_status = -ipc.EPEER;
+        scheduler.readyLocked(client); // its blocked `call` now returns the error
     }
-    scheduler.exitUser();
+    ipc.abandonSenderLocked(t);
+    scheduler.removeFromWaitQueueLocked(t);
+    scheduler.forgetIpcClientLocked(t);
+    ipc.closeHandles(t);
+    if (t.exit_endpoint) |raw| {
+        const endpoint: *ipc.Endpoint = @ptrCast(@alignCast(raw));
+        t.exit_endpoint = null;
+        ipc.notifyLocked(endpoint, abi.notify_exit_bit | t.id);
+        ipc.dropRef(endpoint);
+    }
+}
+
+/// Tear down the current user process and reschedule; never returns. Shared by the
+/// exit system call and the fault path (`killCurrentProcess`). See
+/// `releaseTaskResourcesLocked` for what is released, and in what order.
+pub fn terminateCurrent() noreturn {
+    _ = sync.enter(); // handed off through the exit switch, released by the resumed task
+    terminateCurrentLocked();
+}
+
+/// The body of `terminateCurrent` for a caller that already holds the big kernel
+/// lock — the scheduler's tick calls this (via `terminate_current_hook`) to finish
+/// a deferred process_kill on its own core's current task. Never returns; the
+/// tick's abandoned interrupt frame is fine (the LAPIC was acknowledged before the
+/// tick hook ran), exactly as on the fault path.
+fn terminateCurrentLocked() noreturn {
+    releaseTaskResourcesLocked(scheduler.current());
+    scheduler.exitUserLocked();
+}
+
+/// Reap a condemned task that is NOT running on any core (ready or blocked — and
+/// it cannot start running: state changes need the lock we hold). The other half
+/// of a deferred process_kill, called by the scheduler's tick (via
+/// `reap_task_hook`) and directly by `killProcess` for targets caught off-CPU.
+/// Precondition: the big kernel lock is held.
+fn reapTaskLocked(t: *scheduler.Task) void {
+    releaseTaskResourcesLocked(t);
+    scheduler.removeFromReadyQueueLocked(t); // no-op unless it was ready in a queue
+    scheduler.destroyTaskLocked(t);
+}
+
+/// Kill process `target_id` on behalf of `caller_id` — the kernel half of the
+/// process_kill system call. Returns 0, -ESRCH (no such live process — kernel
+/// tasks are not killable processes and stale ids miss, since ids are never
+/// reused), or -EPERM (the caller is not the target's supervisor).
+///
+/// A target that is ready or blocked is reaped on the spot. One that is running
+/// on another core cannot be torn down mid-instruction, so it is condemned
+/// (`kill_pending`) and dies at its next system_call entry, block, or timer tick
+/// — like a Unix signal, delivery is prompt but asynchronous. Either way the
+/// call returns 0: the kill is accepted and irrevocable.
+pub fn killProcess(caller_id: u32, target_id: u32) i64 {
+    const flags = sync.enter();
+    defer sync.leave(flags);
+    const target = scheduler.taskByIdLocked(target_id) orelse return -ipc.ESRCH;
+    if (target.aspace == 0) return -ipc.ESRCH; // kernel tasks are not processes
+    if (target.supervisor != caller_id) return -ipc.EPERM;
+    if (target.state == .running) {
+        target.kill_pending = true;
+    } else {
+        reapTaskLocked(target);
+    }
+    return 0;
 }
 
 /// Kill the current user process in response to a CPU fault it raised in ring 3.
@@ -865,11 +993,21 @@ fn entryStackBytes(argv: []const []const u8) usize {
 /// convention (`buildEntryStack`). `argv[0]` is required — it names the process:
 /// the path or initial-ramdisk name it was spawned as. It is also recorded on the
 /// task, so a fault report can say *which* binary died, not just its id.
+/// The kernel-internal spawn (init at boot, tests): supervisor 0, no exit
+/// notification. `spawnProcessSupervised` is the full form.
+pub fn spawnProcess(image: []const u8, priority: u3, argv: []const []const u8) InitError!void {
+    _ = try spawnProcessSupervised(image, priority, argv, 0, null);
+}
+
+/// `spawnProcess`, recording `supervisor` (the id of the process that asked — the
+/// kill authority) and, if given, `exit_endpoint` to notify when the child ends
+/// (a reference is taken here and dropped when the notification posts).
+/// Returns the child's process id.
 /// Returns immediately — the process runs preemptively on its own page tables
 /// alongside everything else, and its exit is handled by the system_call layer.
 /// The whole build (address space + ELF load + task) runs under the kernel lock so
 /// it appears atomically and can't race pmm/heap on another core.
-pub fn spawnProcess(image: []const u8, priority: u3, argv: []const []const u8) InitError!void {
+pub fn spawnProcessSupervised(image: []const u8, priority: u3, argv: []const []const u8, supervisor: u32, exit_endpoint: ?*ipc.Endpoint) InitError!u32 {
     if (argv.len == 0 or argv.len > maximum_arguments) return error.BadArguments;
     // The entry block must leave most of the page as actual stack.
     if (entryStackBytes(argv) > page_size / 2) return error.BadArguments;
@@ -901,8 +1039,13 @@ pub fn spawnProcess(image: []const u8, priority: u3, argv: []const []const u8) I
         architecture.mapUserPageInto(aspace, page_virtual, stack_frame, true, false); // RW + NX
     }
 
-    if (!scheduler.spawnUserLocked(aspace, parsed.entry, user_sp, priority, argv[0]))
+    const child = scheduler.spawnUserLocked(aspace, parsed.entry, user_sp, priority, argv[0], supervisor, if (exit_endpoint) |endpoint| @ptrCast(endpoint) else null) orelse
         return error.OutOfMemory;
+    // The child holds a reference to its exit endpoint from birth to death. Taken
+    // only now, after nothing can fail; the lock is still held, so the child
+    // cannot run (let alone die) before the reference exists.
+    if (exit_endpoint) |endpoint| endpoint.refcount += 1;
+    return child;
 }
 
 /// clock() -> nanoseconds since boot: a monotonic time source. The kernel already owns

system/kernel/scheduler.zig

@@ -18,6 +18,7 @@
 //! shared queues.
 
 const std = @import("std");
+const abi = @import("abi");
 const parameters = @import("parameters");
 const architecture = @import("architecture");
 const heap = @import("heap.zig");
@@ -41,6 +42,26 @@ pub const Task = struct {
     kstack_top: usize = 0, // top of `stack` (== TSS.rsp0 for a user task); 0 = none
     wake_at: u64 = 0, // uptime (ms) to wake a sleeping task; 0 = not sleeping
     affinity: ?u32 = null, // null = runs on any core; else the index of its pinned core
+    // --- process management (process.zig) ---
+    // Id of the process that spawned this one (0 = the kernel). The supervision
+    // link is the kill authority: only the supervisor may process_kill a child.
+    supervisor: u32 = 0,
+    // Endpoint to notify when this process ends (any way: exit, fault, kill), or
+    // null. Holds its own reference, dropped when the notification is posted.
+    // Opaque here for the same reason as `handles` below.
+    exit_endpoint: ?*anyopaque = null,
+    // Set by process_kill on a task that is running on another core; the kernel
+    // finishes the kill at that task's next system call or timer tick.
+    kill_pending: bool = false,
+    // True while this task executes its own system call — the timer tick must not
+    // tear a task down in the middle of a kernel operation, only while it runs
+    // user code (or sits at a block point, where teardown is safe).
+    in_system_call: bool = false,
+    // Where this task is parked while blocked, so a kill can unlink it: the
+    // WaitQueue it waits on (maintained by waitLocked/wakeLocked), or the endpoint
+    // whose sender FIFO it queues in (maintained by the IPC layer; opaque here).
+    wait_queue: ?*WaitQueue = null,
+    ipc_wait_endpoint: ?*anyopaque = null,
     // Physical root of this task's address space, or 0 for a kernel task (which
     // runs on the shared kernel page tables). A user task carries its own.
     aspace: u64 = 0,
@@ -85,8 +106,9 @@ pub const Task = struct {
 };
 
 /// Capacity of `Task.name_buffer` — matches the longest name `system_spawn`
-/// accepts, so a spawned name is never truncated.
-pub const maximum_task_name = 64;
+/// accepts, so a spawned name is never truncated. Shared with the ABI's
+/// ProcessDescriptor, so `enumerate` copies names without clipping.
+pub const maximum_task_name = abi.maximum_process_name;
 
 /// Size of each task's IPC handle table. Kept here (not in ipc_sync.zig) because
 /// it dimensions a field of `Task`; ipc_sync.zig re-exports it.
@@ -275,14 +297,18 @@ pub fn spawnOn(entry: *const fn () void, priority: Priority, cpu: u32) bool {
 
 /// Spawn a **user** task: a task with its own address space (`aspace`) that starts
 /// in user mode at `entry` on `user_sp`, recorded under `name` (its argv[0]).
+/// `supervisor` is the id of the spawning process (0 = the kernel) — the kill
+/// authority — and `exit_endpoint` (an *ipc.Endpoint whose reference the caller
+/// has already taken, or null) is notified when this process ends.
 /// It gets a fresh kernel stack for syscalls/interrupts, and its first switch-in
 /// lands in `user_task_trampoline`.
-/// Returns false (creating nothing) if the table is full or out of memory.
+/// Returns the new process id, or null (creating nothing) if the table is full or
+/// out of memory.
 /// **Caller must hold the kernel lock** (the loader that builds `aspace` holds it
 /// across the whole spawn, so the address space and the task appear atomically).
-pub fn spawnUserLocked(aspace: u64, entry: u64, user_sp: u64, priority: Priority, task_name: []const u8) bool {
-    const t = freeSlot() orelse return false;
-    const stack = heap.allocator().alloc(u8, stack_size) catch return false;
+pub fn spawnUserLocked(aspace: u64, entry: u64, user_sp: u64, priority: Priority, task_name: []const u8, supervisor: u32, exit_endpoint: ?*anyopaque) ?u32 {
+    const t = freeSlot() orelse return null;
+    const stack = heap.allocator().alloc(u8, stack_size) catch return null;
     t.* = .{
         .id = next_id,
         .state = .ready,
@@ -291,6 +317,8 @@ pub fn spawnUserLocked(aspace: u64, entry: u64, user_sp: u64, priority: Priority
         .aspace = aspace,
         .user_ip = entry,
         .user_sp = user_sp,
+        .supervisor = supervisor,
+        .exit_endpoint = exit_endpoint,
     };
     const name_length = @min(task_name.len, maximum_task_name);
     @memcpy(t.name_buffer[0..name_length], task_name[0..name_length]);
@@ -302,7 +330,7 @@ pub fn spawnUserLocked(aspace: u64, entry: u64, user_sp: u64, priority: Priority
     // the user entry/stack from the Task itself).
     t.sp = architecture.initTaskStack(top, @intFromPtr(&startUserTask));
     enqueue(t);
-    return true;
+    return t.id;
 }
 
 /// The first thing a fresh user task runs (in ring 0, via task_trampoline). It
@@ -414,6 +442,7 @@ pub const WaitQueue = struct {
 pub fn waitLocked(wait_queue: *WaitQueue) void {
     const t = current();
     t.state = .blocked;
+    t.wait_queue = wait_queue; // so a kill can unlink a parked waiter
     t.next = wait_queue.head;
     wait_queue.head = t;
     schedule();
@@ -438,10 +467,78 @@ pub fn wakeLocked(wait_queue: *WaitQueue) void {
     }
     const t = best orelse return;
     if (best_previous) |p| p.next = t.next else wait_queue.head = t.next;
+    t.wait_queue = null;
     t.state = .ready;
     enqueue(t);
 }
 
+/// Unlink `t` from the wait queue it is parked on, if any (the kill path — a
+/// killed waiter must not be woken later as a dangling pointer). Precondition:
+/// the big kernel lock is held.
+pub fn removeFromWaitQueueLocked(t: *Task) void {
+    const wait_queue = t.wait_queue orelse return;
+    t.wait_queue = null;
+    var previous: ?*Task = null;
+    var node = wait_queue.head;
+    while (node) |n| : ({
+        previous = n;
+        node = n.next;
+    }) {
+        if (n != t) continue;
+        if (previous) |p| p.next = t.next else wait_queue.head = t.next;
+        t.next = null;
+        return;
+    }
+}
+
+/// Unlink `t` from the ready queue it sits in (global, or its affinity core's
+/// pinned queue) — the kill path for a task that is runnable but not running.
+/// Precondition: the big kernel lock is held.
+pub fn removeFromReadyQueueLocked(t: *Task) void {
+    if (t.affinity) |cpu| {
+        const pc = &cpus[cpu];
+        removeFrom(&pc.pinned_head, &pc.pinned_tail, &pc.pinned_bitmap, t);
+    } else {
+        removeFrom(&ready_head, &ready_tail, &ready_bitmap, t);
+    }
+}
+
+fn removeFrom(head: *[number_priorities]?*Task, tail: *[number_priorities]?*Task, bitmap: *u8, t: *Task) void {
+    const level: usize = t.priority;
+    var previous: ?*Task = null;
+    var node = head[level];
+    while (node) |n| : ({
+        previous = n;
+        node = n.next;
+    }) {
+        if (n != t) continue;
+        if (previous) |p| p.next = t.next else head[level] = t.next;
+        if (tail[level] == t) tail[level] = previous;
+        if (head[level] == null) bitmap.* &= ~(@as(u8, 1) << @intCast(level));
+        t.next = null;
+        return;
+    }
+}
+
+/// Find a live task by process id, or null. Ids are monotonic and never reused,
+/// so a stale id misses cleanly rather than naming a recycled slot.
+/// Precondition: the big kernel lock is held.
+pub fn taskByIdLocked(id: u32) ?*Task {
+    for (&tasks) |*t| {
+        if (t.state != .free and t.id == id) return t;
+    }
+    return null;
+}
+
+/// Make every server that still holds `t` as the client it owes a reply to forget
+/// it — the reply of a dead client is dropped, not delivered into freed state.
+/// Precondition: the big kernel lock is held.
+pub fn forgetIpcClientLocked(t: *Task) void {
+    for (&tasks) |*other| {
+        if (other.state != .free and other.ipc_client == t) other.ipc_client = null;
+    }
+}
+
 /// Block the current task and switch away, without putting it on any wait queue —
 /// the caller has already linked it wherever it belongs (e.g. an endpoint's sender
 /// FIFO). Precondition: the big kernel lock is held; still held on return (when the
@@ -501,14 +598,55 @@ fn wakeExpired() void {
     }
 }
 
+// Process-teardown hooks, registered by process.zig at init — the scheduler sits
+// below the process layer, so finishing a kill (IRQ bindings, IPC handles, exit
+// notification) is called *up* through these, mirroring how the architecture
+// layer calls up into `tick`.
+//
+// `terminate_current_hook` ends the task running on THIS core (lock held, never
+// returns — it switches away like `exitUserLocked`). `reap_task_hook` tears down
+// a task that is NOT running on any core (lock held).
+pub var terminate_current_hook: ?*const fn () noreturn = null;
+pub var reap_task_hook: ?*const fn (*Task) void = null;
+
+/// Finish any pending kills this core can see (the deferred half of process_kill;
+/// the immediate half runs in the killer's own call). Precondition: the big kernel
+/// lock is held, from `tick`.
+///
+/// - This core's *current* task, if condemned, is terminated here — but only when
+///   it is not inside one of its own system calls (`in_system_call`): the tick may
+///   have interrupted kernel code mid-operation, where teardown would leak or
+///   corrupt what that operation holds. User-mode execution (and the system_call
+///   entry/exit stubs, which hold nothing) are safe termination points. A task
+///   that *is* mid-call dies at its next block, tick, or system_call entry instead.
+///   The hook never returns; abandoning the interrupt frame is fine — the LAPIC
+///   was acknowledged before the tick hook ran (see apic.timerTick), exactly as on
+///   the fault-kill path.
+/// - Condemned tasks that are ready or blocked are not running anywhere (state
+///   changes need the lock we hold), so they are reaped in place.
+fn reapKillPendingLocked() void {
+    const pc = thisCpu();
+    const cur = pc.current;
+    if (cur.kill_pending and cur.aspace != 0 and !cur.in_system_call) {
+        if (terminate_current_hook) |hook| hook(); // noreturn
+    }
+    if (reap_task_hook) |hook| {
+        for (&tasks) |*t| {
+            if (!t.kill_pending) continue;
+            if (t.state == .ready or t.state == .blocked) hook(t);
+        }
+    }
+}
+
 /// Called from the timer interrupt (interrupts already disabled): wake due
-/// sleepers, then preempt. Takes the kernel lock like any other critical section,
-/// but releases it *without* touching the interrupt flag — the handler's `iretq`
-/// restores the interrupted context's flags, so re-enabling here would open a
-/// nested-interrupt window before the return.
+/// sleepers, finish pending kills, then preempt. Takes the kernel lock like any
+/// other critical section, but releases it *without* touching the interrupt flag
+/// — the handler's `iretq` restores the interrupted context's flags, so
+/// re-enabling here would open a nested-interrupt window before the return.
 pub fn tick() void {
     _ = sync.enter();
     wakeExpired();
+    reapKillPendingLocked();
     if (preemption_enabled) schedule();
     sync.leaveIsr();
 }
@@ -540,6 +678,13 @@ pub fn exit() noreturn {
 /// itself is leaked, as in `exit` (no reaper yet). Never returns.
 pub fn exitUser() noreturn {
     _ = sync.enter();
+    exitUserLocked();
+}
+
+/// The body of `exitUser` for callers that already hold the big kernel lock (the
+/// tick-time terminate path, which enters with the lock held). The lock is handed
+/// off through the switch and released by the task that resumes. Never returns.
+pub fn exitUserLocked() noreturn {
     const pc = thisCpu();
     const dying = pc.current;
     const as = dying.aspace;
@@ -551,6 +696,8 @@ pub fn exitUser() noreturn {
     }
     dying.state = .free;
     dying.aspace = 0;
+    dying.kill_pending = false;
+    dying.in_system_call = false;
     const next = dequeueHighest(pc) orelse @panic("sched: no task left to run");
     next.state = .running;
     pc.current = next;
@@ -559,6 +706,54 @@ pub fn exitUser() noreturn {
     unreachable;
 }
 
+/// Free a task that is NOT running on any core (it is ready or blocked, and the
+/// caller — the kill path — has already unlinked it from every queue and released
+/// what it held). Destroys its address space: safe here because no core can have
+/// it loaded (every switch away from a task loads the next task's tables, and the
+/// task isn't running). The kernel stack is leaked, as in `exitUser` (no reaper
+/// yet). Precondition: the big kernel lock is held.
+pub fn destroyTaskLocked(t: *Task) void {
+    if (t.aspace != 0) architecture.destroyAddressSpace(t.aspace);
+    t.aspace = 0;
+    t.kill_pending = false;
+    t.in_system_call = false;
+    t.wake_at = 0;
+    t.state = .free;
+}
+
+/// Snapshot the task table into `out` (up to its length), returning the total
+/// number of live tasks — the kernel half of `process_enumerate`, mirroring
+/// devices_broker.enumerate. Kernel tasks are included (empty name, supervisor 0):
+/// an honest `ps` shows the idle tasks too. `out` may be user memory: the caller's
+/// address space is loaded during its system call, and the same bring-up trust
+/// applies as for device_enumerate (an unmapped user page faults the kernel).
+pub fn enumerate(out: []abi.ProcessDescriptor) u64 {
+    const flags = sync.enter();
+    defer sync.leave(flags);
+    var total: u64 = 0;
+    for (&tasks) |*t| {
+        if (t.state == .free) continue;
+        if (total < out.len) {
+            const d = &out[total];
+            d.* = .{
+                .id = t.id,
+                .supervisor = t.supervisor,
+                .state = @intFromEnum(@as(abi.ProcessState, switch (t.state) {
+                    .ready => .ready,
+                    .running => .running,
+                    .blocked => .blocked,
+                    .free => unreachable,
+                })),
+                .priority = t.priority,
+                .name_length = t.name_length,
+                .name = t.name_buffer,
+            };
+        }
+        total += 1;
+    }
+    return total;
+}
+
 /// Whether the running task is a user process (has its own address space).
 pub fn currentIsUserProcess() bool {
     return current().aspace != 0;

system/kernel/tests.zig

@@ -126,6 +126,12 @@ pub fn run(case: []const u8, boot_information: *const BootInformation) void {
         initTest(boot_information);
     } else if (eql(case, "process")) {
         processTest(boot_information);
+    } else if (eql(case, "process-list")) {
+        processListTest(boot_information);
+    } else if (eql(case, "process-kill")) {
+        processKillTest(boot_information);
+    } else if (eql(case, "supervision")) {
+        supervisionTest(boot_information);
     } else if (eql(case, "initial-ramdisk")) {
         initialRamdiskTest(boot_information);
     } else if (eql(case, "vfs")) {
@@ -1222,7 +1228,7 @@ fn spawnFaultingProcess() bool {
     };
     architecture.mapUserPageInto(aspace, process.stack_base_virtual, stack_frame, true, false); // RW + NX
 
-    if (!scheduler.spawnUserLocked(aspace, process.code_virtual, process.stack_base_virtual + abi.page_size, 4, "fault-probe")) {
+    if (scheduler.spawnUserLocked(aspace, process.code_virtual, process.stack_base_virtual + abi.page_size, 4, "fault-probe", 0, null) == null) {
         architecture.destroyAddressSpace(aspace);
         return false;
     }
@@ -1311,6 +1317,189 @@ fn initTest(boot_information: *const BootInformation) void {
     result();
 }
 
+/// process_enumerate's kernel half: spawn two init processes next to the kernel
+/// tasks and snapshot the table. The snapshot must list both by name with distinct,
+/// kernel-supervised ids, include the kernel tasks (id 0, empty name), and report
+/// the same total through a too-small buffer (the truncation contract: the caller
+/// learns how big a buffer to bring).
+fn processListTest(boot_information: *const BootInformation) void {
+    log("DANOS-TEST-BEGIN: process-list\n", .{});
+    check("bootloader handed over /system/services/init", boot_information.init_len != 0);
+    if (boot_information.init_len == 0) {
+        result();
+        return;
+    }
+    const image = @as([*]const u8, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.init_base)))[0..boot_information.init_len];
+
+    var spawned: u32 = 0;
+    if (process.spawnProcess(image, 4, &.{"/system/services/init"})) spawned += 1 else |_| {}
+    if (process.spawnProcess(image, 4, &.{"/system/services/init"})) spawned += 1 else |_| {}
+    check("two init processes spawned", spawned == 2);
+
+    var table: [32]abi.ProcessDescriptor = undefined;
+    const total = scheduler.enumerate(&table);
+    check("enumerate counts the boot task and both processes (>=3)", total >= 3);
+
+    var inits: u32 = 0;
+    var init_ids: [2]u32 = .{ 0, 0 };
+    var kernel_task_seen = false;
+    var states_sane = true;
+    for (table[0..@min(total, table.len)]) |descriptor| {
+        if (descriptor.state > @intFromEnum(abi.ProcessState.blocked)) states_sane = false;
+        if (descriptor.name_length == 0) kernel_task_seen = true;
+        if (eql(descriptor.name[0..descriptor.name_length], "/system/services/init")) {
+            if (inits < 2) init_ids[inits] = descriptor.id;
+            inits += 1;
+            check("init entry is kernel-supervised (supervisor 0)", descriptor.supervisor == 0);
+        }
+    }
+    check("both init processes listed by name", inits == 2);
+    check("listed processes carry distinct ids", init_ids[0] != init_ids[1]);
+    check("kernel tasks are listed too (empty name)", kernel_task_seen);
+    check("every state is a ProcessState value", states_sane);
+
+    var one: [1]abi.ProcessDescriptor = undefined;
+    check("a too-small buffer still learns the true total", scheduler.enumerate(&one) == total);
+    result();
+}
+
+/// process_kill + the exit notification, kernel half. Two victims, two paths:
+/// - init, which heartbeats and sleeps: caught blocked, reaped on the killer's
+///   own call — and its heartbeat must stop.
+/// - process-test's spinner role (from the initial ramdisk), which loops in user
+///   mode making no system calls: with more cores it is caught running, taking
+///   the deferred path (kill_pending, finished by the victim core's next tick).
+/// Each death must post one exit notification badge (exit bit + the child's id)
+/// on the endpoint given at spawn; wrong-supervisor and unknown-id kills must be
+/// refused. The waits block in replyWait, so a lost notification times the
+/// harness out rather than passing vacuously.
+fn processKillTest(boot_information: *const BootInformation) void {
+    log("DANOS-TEST-BEGIN: process-kill\n", .{});
+    check("bootloader handed over /system/services/init", boot_information.init_len != 0);
+    if (boot_information.init_len == 0 or boot_information.initial_ramdisk_len == 0) {
+        check("bootloader handed over an initial_ramdisk", boot_information.initial_ramdisk_len != 0);
+        result();
+        return;
+    }
+    const image = @as([*]const u8, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.init_base)))[0..boot_information.init_len];
+    const ramdisk = @as([*]const u8, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.initial_ramdisk_base)))[0..boot_information.initial_ramdisk_len];
+    const rd = initial_ramdisk.Reader.init(ramdisk) orelse {
+        check("initial_ramdisk image is valid", false);
+        result();
+        return;
+    };
+
+    const me = scheduler.currentId();
+    const endpoint = ipcsync.createIpcEndpoint() orelse {
+        check("exit endpoint allocated", false);
+        result();
+        return;
+    };
+
+    process.write_count = 0;
+    const sleeper = process.spawnProcessSupervised(image, 4, &.{"/system/services/init"}, me, endpoint) catch 0;
+    check("init spawned as the supervised sleeper victim", sleeper != 0);
+
+    // Let it reach its heartbeat loop (write, then a 1 s sleep) so the kill most
+    // likely catches it blocked.
+    scheduler.setPriority(1);
+    const deadline = architecture.millis() + 8000;
+    while (process.write_count < 1 and architecture.millis() < deadline) scheduler.yield();
+    scheduler.setPriority(4);
+    check("victim heartbeat before the kill", process.write_count >= 1);
+
+    // Kills that must be refused, before the one that must not be.
+    check("a non-supervisor may not kill (-EPERM)", process.killProcess(me + 12345, sleeper) == -ipcsync.EPERM);
+    check("an unknown id misses (-ESRCH)", process.killProcess(me, 0xFFFF_FF00) == -ipcsync.ESRCH);
+    check("a kernel task is not a killable process (-ESRCH)", process.killProcess(me, 0) == -ipcsync.ESRCH);
+
+    check("the supervisor's kill is accepted", process.killProcess(me, sleeper) == 0);
+
+    var badge: u64 = 0;
+    var received_cap: u64 = 0;
+    var r = ipcsync.replyWait(endpoint, 0, 0, 0, 0, abi.no_cap, &badge, &received_cap);
+    check("the sleeper's exit notification arrived (length 0)", r == 0);
+    check("its badge carries the exit bit and the child id", badge == abi.notify_badge_bit | abi.notify_exit_bit | sleeper);
+
+    const beats_at_kill = process.write_count;
+    scheduler.sleep(1500); // more than one heartbeat period
+    check("the heartbeat stopped with the kill", process.write_count == beats_at_kill);
+
+    // The spinner: no system calls, so only the tick can deliver a deferred kill.
+    var spinner: u32 = 0;
+    var i: u32 = 0;
+    while (i < rd.count) : (i += 1) {
+        const item = rd.entry(i) orelse continue;
+        if (!eql(item.name, "process-test")) continue;
+        spinner = process.spawnProcessSupervised(item.blob, 4, &.{ "process-test", "spinner" }, me, endpoint) catch 0;
+        break;
+    }
+    check("process-test spawned as the supervised spinner victim", spinner != 0);
+    scheduler.sleep(100); // give another core a chance to be running it
+    check("the spinner's kill is accepted", process.killProcess(me, spinner) == 0);
+    r = ipcsync.replyWait(endpoint, 0, 0, 0, 0, abi.no_cap, &badge, &received_cap);
+    check("the spinner's exit notification arrived (length 0)", r == 0);
+    check("its badge carries the exit bit and the child id", badge == abi.notify_badge_bit | abi.notify_exit_bit | spinner);
+
+    var table: [32]abi.ProcessDescriptor = undefined;
+    const total = scheduler.enumerate(&table);
+    var still_listed = false;
+    for (table[0..@min(total, table.len)]) |descriptor| {
+        if (descriptor.id == sleeper or descriptor.id == spinner) still_listed = true;
+    }
+    check("neither victim is listed after its kill", !still_listed);
+    check("a killed id stays dead (-ESRCH on a second kill)", process.killProcess(me, sleeper) == -ipcsync.ESRCH);
+    result();
+}
+
+/// The whole user-side surface at once: spawn process-test's supervisor role,
+/// which — entirely from ring 3 — creates an exit endpoint, spawns its two
+/// children supervised, sees them in process_enumerate, kills them (one blocked,
+/// one spinning), collects both exit notifications, and confirms they are gone.
+/// Its "process-test: ok" is the pass marker; any FAIL line is specific.
+fn supervisionTest(boot_information: *const BootInformation) void {
+    log("DANOS-TEST-BEGIN: supervision\n", .{});
+    check("bootloader handed over an initial_ramdisk", boot_information.initial_ramdisk_len != 0);
+    if (boot_information.initial_ramdisk_len == 0) {
+        result();
+        return;
+    }
+    const ramdisk = @as([*]const u8, @ptrFromInt(boot_handoff.physicalToVirtual(boot_information.initial_ramdisk_base)))[0..boot_information.initial_ramdisk_len];
+    const rd = initial_ramdisk.Reader.init(ramdisk) orelse {
+        check("initial_ramdisk image is valid", false);
+        result();
+        return;
+    };
+    process.setInitialRamdisk(ramdisk); // the supervisor system_spawns its children by name
+
+    process.write_count = 0;
+    process.write_from_user = false;
+    var started = false;
+    var i: u32 = 0;
+    while (i < rd.count) : (i += 1) {
+        const item = rd.entry(i) orelse continue;
+        if (!eql(item.name, "process-test")) continue;
+        started = if (process.spawnProcess(item.blob, 4, &.{ "process-test", "run" })) true else |_| false;
+        break;
+    }
+    check("process-test spawned as the user-space supervisor", started);
+
+    const marker = "process-test: ok";
+    scheduler.setPriority(1);
+    const deadline = architecture.millis() + 10000;
+    while (architecture.millis() < deadline) {
+        if (process.write_len >= marker.len and eql(process.write_buffer[0..marker.len], marker)) break;
+        scheduler.yield();
+    }
+    scheduler.setPriority(4);
+
+    const ok = process.write_len >= marker.len and eql(process.write_buffer[0..marker.len], marker);
+    if (!ok and process.write_len > 0) log("DANOS-SUPERVISION: got \"{s}\"\n", .{process.write_buffer[0..process.write_len]});
+    check("the supervisor completed every step (spawn/list/kill/notify)", ok);
+    check("it ran in user mode (CPL 3)", process.write_from_user);
+    result();
+}
+
 /// The initial_ramdisk path: the bootloader handed over an image bundling extra user
 /// binaries; parse it, spawn every program, and confirm one (the vfs stub)
 /// reaches ring 3 and heartbeats — proving the whole ferry-parse-spawn pipeline.