feat(sched): Preemptive Weave scheduling driven by the timer tick

Kernel threads were only ever switched cooperatively (sched_yield, task_exit);
a thread that never yielded held the CPU forever. The Weave scheduler now
preempts from the PIT tick, so CPU-bound threads are time-sliced.

Deferred switch, not mid-handler:
- sched_tick() no longer switches. It charges the running quantum and, when it
  is spent, only raises weave_need_resched. The switch happens at IRQ return in
  the new sched_preempt_on_return(), called from the x86_64 dispatcher after
  the PIC EOI. That keeps the tick path re-entrancy-safe (the EOI is already
  out, so the PIC keeps delivering) and lets the preempted thread unwind
  through the normal iretq on its own kernel stack.

Interrupt-atomic scheduler state:
- The plain weave_lock is not IRQ-safe, so a tick landing mid-mutation would
  deadlock. weave_lock sections now mask interrupts (arch_irq_save/restore,
  added to arch.h for all three arches) so the timer can never fire inside
  them, and weave_rotate holds them masked across the pick and the register
  swap so the switch is one indivisible step.

Preemption-disable count:
- sched_preempt_disable/enable gate the tick and the return-path switch so a
  preemptive switch cannot land while a plain (non-IRQ-safe) spinlock is held.
  printk wraps its critical section with it, closing the most common hazard;
  other locks are a documented follow-up.

Fresh threads opt into interrupts at entry so they are preemptible from birth
without changing the cooperative early-boot self-test, which still runs with
interrupts masked and is unchanged (20 switches, 3/3 workers).

Verified on x86_64 under QEMU: a new boot-time self-test arms preemption and
two threads that NEVER yield are forced to share the CPU -- 20 involuntary
switches, both advance and are woven down to the CPU-bound lanes -- then boot
proceeds cleanly to ring-3 /sbin/init and the shell with zero faults. aarch64
and armv8i still build; preemption is wired into the x86_64 IRQ path only, so
those stay cooperative for now (their switch asm already exists).

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_0161Jh7uCEMLYEMNPsjC1LKf

docs/AUTODEV_ROADMAP.md

@@ -20,6 +20,25 @@ refine the backlog.
 
 ## DONE
 
+- **Preemptive Weave scheduling from the timer tick** (2026-08-25):
+  The PIT tick now drives involuntary context switches. sched_tick() only
+  records that a quantum is spent (weave_need_resched); the switch happens at
+  IRQ return in sched_preempt_on_return(), after the PIC EOI, on the
+  interrupted thread's own kernel stack -- so the tick path stays re-entrancy
+  safe and threads unwind cleanly through the normal iretq. The scheduler's
+  lock sections were made interrupt-atomic (arch_irq_save/restore, new in
+  arch.h) so the timer can never fire mid-mutation, and a preemption-disable
+  count (sched_preempt_disable/enable, used by printk) keeps a switch from
+  landing while a plain spinlock is held. Fresh preemptible kernel threads opt
+  into interrupts at entry. Verified on x86_64 under QEMU: a boot-time self-test
+  arms preemption and two NON-yielding worker threads are forced to share the
+  CPU -- 20 involuntary switches, both workers advance and are woven down to the
+  CPU-bound lanes -- then boot proceeds cleanly to ring-3 init and the shell
+  with no faults. (Debugging note: an early re-entrancy guard deadlocked all
+  preemption because sched_schedule() does not return to its caller until that
+  thread is rescheduled; it was removed, since the masked switch already
+  prevents nesting.)
+
 - **Weave scheduler + real kernel-thread context switching** (2026-08-25):
   Replaced the state-relabel-only round-robin with the SUB-OS "Weave" tiered
   scheduler backed by a genuine callee-saved context switch (`sub_ctx_switch`,
@@ -33,27 +52,21 @@ refine the backlog.
 
 ## NEXT (prioritized backlog)
 
-1. **Preemptive Weave scheduling from the timer tick.** The plumbing exists
-   (`sched_set_preempt`, `sched_tick` charges the quantum). Arm it *after* boot
-   completes, make the PIT ISR path re-entrancy-safe (switch on IRQ return, not
-   mid-handler), and add a preemption self-test showing a CPU-bound thread being
-   woven down while an interactive one stays in lane 0. Needs an IRQ-context
-   switch (save the full trap frame, not just callee-saved state).
-2. **Thread reaping / zombie cleanup.** Exited kernel threads currently leak
+1. **Thread reaping / zombie cleanup.** Exited kernel threads currently leak
    their 16 KB stack + task_t. Add a reaper (per-CPU dead list drained by the
    idle thread) so `task_exit` hands the corpse to it instead of leaking.
-3. **Boot-test the ARM context switch.** Wire a `weave_selftest()` call into the
+2. **Boot-test the ARM context switch.** Wire a `weave_selftest()` call into the
    aarch64/armv8i boot paths and boot under `qemu-system-aarch64`/`-arm` to
    confirm the AArch64/AArch32 `sub_ctx_switch` frames are correct.
-4. **fork/exec/wait for the ring-3 userland.** Build on the existing ELF64
+3. **fork/exec/wait for the ring-3 userland.** Build on the existing ELF64
    loader + per-process page tables so `sh` can spawn and reap real children,
    not just the single builtin init.
-5. **An original capability-based IPC channel** ("sub-ports"): typed,
+4. **An original capability-based IPC channel** ("sub-ports"): typed,
    capability-addressed message endpoints distinct from the SysV msg/pipe/shm
    set already present in `ipc/` — leaning into the "object-first" identity.
-6. **SMP bring-up (x86_64):** AP boot trampoline, per-CPU run lanes, and making
+5. **SMP bring-up (x86_64):** AP boot trampoline, per-CPU run lanes, and making
    the Weave lanes per-CPU with work-stealing between them.
-7. **GUI (feat/gui-desktop):** compositor damage tracking, a VFS-backed file
+6. **GUI (feat/gui-desktop):** compositor damage tracking, a VFS-backed file
    manager, a text editor, and a settings panel over the toolkit widgets.
 
 ## Notes / gotchas
@@ -63,5 +76,9 @@ refine the backlog.
   (`l`, `ll`) and no field width; cast to `int`/`unsigned`/`void*`.
 - `list_del()` NULLs both links, so `list_empty()` is not a reliable "is this
   node queued?" test after a delete — check the links directly.
+- Preemption is armed after boot (step 14). A switch must NOT run while a plain
+  spinlock is held: wrap such sections with sched_preempt_disable/enable (printk
+  already does). weave_lock sections use arch_irq_save/restore so the tick
+  cannot fire inside them.
 - During `subos_modular_core_boot()` step 13, hardware interrupts are still
   masked (enabled at step 14), so cooperative in-boot tests are deterministic.