Struct HandoffProbe 

pub(crate) struct HandoffProbe {
    pub(crate) median: u64,
    pub(crate) p99: u64,
}

Re-execute this image to service a kernel-requested restart.

drop_all_capabilities() runs after every successful attach, and a permitted set cleared through capset cannot be regained in-process — file capabilities are applied only at execve. Re-entering Scheduler::init would therefore fail BPF_PROG_LOAD with EPERM and kill the scheduler instead of restarting it. Exec’ing ourselves restores the file capabilities from the bounding set (which capset never touched), keeps the PID and /proc/<pid>/exe identity the bench runner verifies, and re-runs PR_SET_DUMPABLE on the way in. The struct_ops link is already dropped by run(), so the scheduler is detached before we replace the image. One host’s wake+block+switch hop, as a distribution rather than a mean.

Fields

median: u64

Typical hop — the switch-cost anchor for the preempt-protect window.

p99: u64

Tail of a GENUINE handoff. This is the admission threshold itself, not a base to multiply: measured 2026-07-30, using 2 * mean instead cost mutex-handoff -35.66% (CI[-40.01,-31.31]) with migrations 2.4-2.7x up, because enough real handoffs land in the tail above the mean that a mean-derived cut loses them. The in-tree dose-response wanted a 99.67% firing rate on this workload, so the statistic that matches the requirement is a high percentile, not an invented multiplier.