[DjDeveloperr]

A closed G17 context could be killed twice: once through its compute queue (#505) and again on its render pairs' behalf (#508). Only timing prevented it, and a second kill is harmful. This records on the context that a kill was published and never publishes another.

The hazard

#508 publishes a render-only kill for a closed context whose pairs hold executed but unstamped commands, while no compute queue still runs it, switches away from it or killed it. A context killed through its compute queue normally leaves that state in the same service pass, because the acknowledged kill releases the pair. The compute queue's own record of the kill ends when the queue is rebound, so if the pair's release lags behind that, the context looks like a render-only candidate again.

A diagnostic run that held the pair's release back for 100 ms after the kill showed what follows:

• 31 contexts were killed twice, 0.1 to 2.5 ms apart.
• Twice the firmware recovered the GPU 0.3 ms after acknowledging the second kill, on a page fault in the killed pair's own tiling queue.
• The 35 contexts killed once in the same run caused no recovery.

No production run so far had a double kill, but nothing in the code ruled it out.

The change

• Context gains a kill_published flag, set by both publish_compute_exit and publish_render_kill once the kill record is published.
• render_kill_candidate refuses a context with the flag set. The eligibility test is a pure helper (render_kill_eligible) with a KUnit case.

Testing

• KUnit (asahi_g17*, 125 cases), new: a killed context is never killed again.
• Regression gate on this build: PERFORMANCE-REGRESSION-PASS.
• Targeted CTS (5368 cases): 4687 pass, 681 not supported, 0 fail, with 0 asahi kernel errors.
• Two-client ray-query pairs run (10 minutes) on this build: queued while the Neo is reserved; the result will follow in a comment.

[DjDeveloperr]

Two-client ray-query pairs run (10 minutes) on this build (module b0e2c572):

	result
faults	62
kills, all acknowledged and their pairs retired	62 (all through compute queues; no render-only candidate came up)
contexts killed twice	0
GPU recoveries / firmware crashes	0 / 0
EBUSY / capacity refusals	0 / 0
teardowns pending / pairs quarantined after the run	0 / 0
memory-pressure kills (none followed by a recovery)	14
GPU memory peak (device limit 5083 MiB)	4400 MiB, no allocation refused
gnome-shell	alive

The physical queue table reached 127/128, with killed pairs reused 11 times and no refusals.