diff --git a/build/README.md b/build/README.md
index 6cd1781a..955a6058 100644
--- a/build/README.md
+++ b/build/README.md
@@ -114,6 +114,11 @@ and this guest has `CONFIG_MODULES` off and no `/lib/modules` at all.
 - **`vmlinux`, not `bzImage`.** The guest is loaded as a raw ELF with no
   bootloader in the path. It is ~16 MB unstripped, which costs nothing at run
   time: only the loadable segments are mapped.
+- **Built with clang, thin-LTO.** `kernel-build.sh` passes `LLVM=1` to every
+  step, config included, because `HAS_LTO_CLANG` is decided when Kconfig runs
+  and gcc would make `olddefconfig` drop `LTO_CLANG_THIN` silently. `clang`,
+  `ld.lld` and the `llvm-*` binutils must be on `PATH`; the build says which is
+  missing before it starts.
 - **`-march=x86-64-v3`** goes in through `KCFLAGS`. It is safe in a kernel:
   the kernel's own `-mno-sse -mno-avx …` masks every vector extension off
   whatever the flag order, leaving v3's integer ISA.
diff --git a/build/kernel/base.config b/build/kernel/base.config
index ccbde962..803864e3 100644
--- a/build/kernel/base.config
+++ b/build/kernel/base.config
@@ -1,20 +1,21 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 7.1.5 Kernel Configuration
+# Linux/x86 7.2.6 Kernel Configuration
 #
-CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.2.1 20260810"
-CONFIG_CC_IS_GCC=y
-CONFIG_GCC_VERSION=160201
-CONFIG_CLANG_VERSION=0
-CONFIG_AS_IS_GNU=y
-CONFIG_AS_VERSION=24700
-CONFIG_LD_IS_BFD=y
-CONFIG_LD_VERSION=24700
-CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=109701
+CONFIG_CC_VERSION_TEXT="clang version 22.1.8"
+CONFIG_GCC_VERSION=0
+CONFIG_CC_IS_CLANG=y
+CONFIG_CLANG_VERSION=220108
+CONFIG_AS_IS_LLVM=y
+CONFIG_AS_VERSION=220108
+CONFIG_LD_VERSION=0
+CONFIG_LD_IS_LLD=y
+CONFIG_LLD_VERSION=220108
+CONFIG_RUSTC_VERSION=109801
 CONFIG_RUST_IS_AVAILABLE=y
-CONFIG_RUSTC_LLVM_VERSION=220106
+CONFIG_RUSTC_LLVM_VERSION=220108
 CONFIG_RUSTC_LLVM_MAJOR_VERSION=22
+CONFIG_RUSTC_CLANG_LLVM_COMPATIBLE=y
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y
 CONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y
@@ -24,13 +25,15 @@ CONFIG_CC_HAS_ASSUME=y
 CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
 CONFIG_CC_HAS_COUNTED_BY=y
 CONFIG_CC_HAS_COUNTED_BY_PTR=y
+CONFIG_CC_HAS_ALLOC_TOKEN=y
 CONFIG_CC_HAS_MULTIDIMENSIONAL_NONSTRING=y
 CONFIG_LD_CAN_USE_KEEP_IN_OVERLAY=y
 CONFIG_RUSTC_HAS_SPAN_FILE=y
 CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES=y
 CONFIG_RUSTC_HAS_FILE_WITH_NUL=y
 CONFIG_RUSTC_HAS_FILE_AS_C_STR=y
-CONFIG_PAHOLE_VERSION=131
+CONFIG_RUSTC_HAS_SUSPICIOUS_RUNTIME_SYMBOL_DEFINITIONS=y
+CONFIG_PAHOLE_VERSION=132
 CONFIG_IRQ_WORK=y
 CONFIG_BUILDTIME_TABLE_SORT=y
 CONFIG_THREAD_INFO_IN_TASK=y
@@ -38,6 +41,7 @@ CONFIG_THREAD_INFO_IN_TASK=y
 #
 # General setup
 #
+CONFIG_CACHY=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 # CONFIG_COMPILE_TEST is not set
 # CONFIG_WERROR is not set
@@ -91,7 +95,6 @@ CONFIG_SPARSE_IRQ=y
 CONFIG_CLOCKSOURCE_WATCHDOG=y
 CONFIG_ARCH_CLOCKSOURCE_INIT=y
 CONFIG_ARCH_WANTS_CLOCKSOURCE_READ_INLINE=y
-CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST_IDLE=y
@@ -186,13 +189,12 @@ CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
 CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y
 CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y
 CONFIG_CC_HAS_INT128=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
+CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough"
 CONFIG_CC_MS_EXTENSIONS="-fms-extensions"
 CONFIG_GCC10_NO_ARRAY_BOUNDS=y
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_NO_STRINGOP_OVERFLOW=y
-CONFIG_CC_NO_STRINGOP_OVERFLOW=y
 CONFIG_ARCH_SUPPORTS_INT128=y
+CONFIG_SCHED_CACHE=y
 CONFIG_SLAB_OBJ_EXT=y
 CONFIG_CGROUPS=y
 CONFIG_PAGE_COUNTER=y
@@ -229,11 +231,13 @@ CONFIG_PID_NS=y
 CONFIG_NET_NS=y
 # CONFIG_CHECKPOINT_RESTORE is not set
 CONFIG_SCHED_AUTOGROUP=y
+CONFIG_SCHED_POC_SELECTOR=y
 # CONFIG_RELAY is not set
 # CONFIG_BLK_DEV_INITRD is not set
 # CONFIG_BOOT_CONFIG is not set
 CONFIG_CMDLINE_LOG_WRAP_IDEAL_LEN=1021
 # CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
+# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3 is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_LD_ORPHAN_WARN=y
 CONFIG_LD_ORPHAN_WARN_LEVEL="warn"
@@ -255,6 +259,7 @@ CONFIG_PRINTK=y
 CONFIG_FUTEX=y
 CONFIG_FUTEX_PI=y
 CONFIG_FUTEX_PRIVATE_HASH=y
+CONFIG_HAVE_FUTEX_ROBUST_UNLOCK=y
 CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
@@ -347,6 +352,9 @@ CONFIG_PARAVIRT_CLOCK=y
 # CONFIG_BHYVE_GUEST is not set
 CONFIG_CC_HAS_MARCH_NATIVE=y
 # CONFIG_X86_NATIVE_CPU is not set
+CONFIG_GENERIC_CPU=y
+# CONFIG_MZEN4 is not set
+CONFIG_X86_64_VERSION=1
 CONFIG_X86_INTERNODE_CACHE_SHIFT=6
 CONFIG_X86_L1_CACHE_SHIFT=6
 CONFIG_X86_TSC=y
@@ -420,6 +428,9 @@ CONFIG_X86_INTEL_TSX_MODE_AUTO=y
 # CONFIG_HZ_100 is not set
 # CONFIG_HZ_250 is not set
 # CONFIG_HZ_300 is not set
+# CONFIG_HZ_500 is not set
+# CONFIG_HZ_600 is not set
+# CONFIG_HZ_750 is not set
 CONFIG_HZ_1000=y
 CONFIG_HZ=1000
 CONFIG_SCHED_HRTICK=y
@@ -450,12 +461,11 @@ CONFIG_HAVE_KLP_BUILD=y
 # CONFIG_X86_BUS_LOCK_DETECT is not set
 # end of Processor type and features
 
-CONFIG_CC_HAS_NAMED_AS=y
 CONFIG_CC_HAS_NAMED_AS_FIXED_SANITIZERS=y
-CONFIG_USE_X86_SEG_SUPPORT=y
 CONFIG_CC_HAS_SLS=y
 CONFIG_CC_HAS_RETURN_THUNK=y
 CONFIG_CC_HAS_ENTRY_PADDING=y
+CONFIG_CC_HAS_KCFI_ARITY=y
 CONFIG_FUNCTION_PADDING_CFI=11
 CONFIG_FUNCTION_PADDING_BYTES=16
 # CONFIG_CPU_MITIGATIONS is not set
@@ -585,7 +595,6 @@ CONFIG_AMD_NODE=y
 #
 CONFIG_IA32_EMULATION=y
 # CONFIG_IA32_EMULATION_DEFAULT_DISABLED is not set
-# CONFIG_X86_X32_ABI is not set
 CONFIG_COMPAT_32=y
 CONFIG_COMPAT=y
 CONFIG_COMPAT_FOR_U64_ALIGNMENT=y
@@ -672,6 +681,7 @@ CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y
 CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y
 CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
 CONFIG_ARCH_WANTS_NO_INSTR=y
+CONFIG_ARCH_MEMORY_ORDER_TSO=y
 CONFIG_HAVE_ASM_MODVERSIONS=y
 CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
 CONFIG_HAVE_RSEQ=y
@@ -711,10 +721,17 @@ CONFIG_HAVE_STACKPROTECTOR=y
 # CONFIG_STACKPROTECTOR is not set
 CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
 CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
+CONFIG_HAS_LTO_CLANG=y
 CONFIG_LTO_NONE=y
-CONFIG_ARCH_SUPPORTS_AUTOFDO_CLANG=y
-CONFIG_ARCH_SUPPORTS_PROPELLER_CLANG=y
+# CONFIG_LTO_CLANG_FULL is not set
+# CONFIG_LTO_CLANG_THIN is not set
+# CONFIG_LTO_CLANG_THIN_DIST is not set
+# CONFIG_AUTOFDO_CLANG is not set
+# CONFIG_PROPELLER_CLANG is not set
 CONFIG_ARCH_SUPPORTS_CFI=y
+# CONFIG_CFI is not set
+CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS=y
+CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC=y
 CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y
 CONFIG_HAVE_CONTEXT_TRACKING_USER=y
 CONFIG_HAVE_CONTEXT_TRACKING_USER_OFFSTACK=y
@@ -788,11 +805,9 @@ CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
 # end of GCOV-based kernel profiling
 
 CONFIG_HAVE_GCC_PLUGINS=y
-# CONFIG_GCC_PLUGINS is not set
 CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FUNCTION_ALIGNMENT_16B=y
 CONFIG_FUNCTION_ALIGNMENT=16
-CONFIG_CC_HAS_MIN_FUNCTION_ALIGNMENT=y
 CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT=y
 # end of General architecture-dependent options
 
@@ -819,11 +834,15 @@ CONFIG_MSDOS_PARTITION=y
 CONFIG_EFI_PARTITION=y
 # end of Partition Types
 
+# CONFIG_BLK_ERROR_INJECTION is not set
+
 #
 # IO Schedulers
 #
 CONFIG_MQ_IOSCHED_DEADLINE=y
 CONFIG_MQ_IOSCHED_KYBER=y
+CONFIG_MQ_IOSCHED_ADIOS=y
+# CONFIG_MQ_IOSCHED_DEFAULT_ADIOS is not set
 # CONFIG_IOSCHED_BFQ is not set
 # end of IO Schedulers
 
@@ -911,7 +930,6 @@ CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_NEVER=y
 # CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_WITHIN_SIZE is not set
 # CONFIG_TRANSPARENT_HUGEPAGE_TMPFS_HUGE_ADVISE is not set
 CONFIG_THP_SWAP=y
-# CONFIG_READ_ONLY_THP_FOR_FS is not set
 # CONFIG_NO_PAGE_MAPCOUNT is not set
 CONFIG_PAGE_MAPCOUNT=y
 CONFIG_PGTABLE_HAS_HUGE_LEAVES=y
@@ -1041,7 +1059,6 @@ CONFIG_NET_PTP_CLASSIFY=y
 # CONFIG_NET_DSA is not set
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_LLC2 is not set
-# CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
 # CONFIG_PHONET is not set
@@ -1138,11 +1155,6 @@ CONFIG_PCI_LOCKLESS_CONFIG=y
 # CONFIG_PCI_PASID is not set
 # CONFIG_PCIE_TPH is not set
 CONFIG_PCI_LABEL=y
-# CONFIG_PCIE_BUS_TUNE_OFF is not set
-CONFIG_PCIE_BUS_DEFAULT=y
-# CONFIG_PCIE_BUS_SAFE is not set
-# CONFIG_PCIE_BUS_PERFORMANCE is not set
-# CONFIG_PCIE_BUS_PEER2PEER is not set
 CONFIG_VGA_ARB=y
 CONFIG_VGA_ARB_MAX_GPUS=16
 # CONFIG_HOTPLUG_PCI is not set
@@ -1316,7 +1328,6 @@ CONFIG_VIRTIO_BLK=y
 # CONFIG_ISL29020 is not set
 # CONFIG_SENSORS_TSL2550 is not set
 # CONFIG_SENSORS_BH1770 is not set
-# CONFIG_SENSORS_APDS990X is not set
 # CONFIG_HMC6352 is not set
 # CONFIG_DS1682 is not set
 # CONFIG_SRAM is not set
@@ -1568,6 +1579,7 @@ CONFIG_SERIAL_8250_DWLIB=y
 #
 # Non-8250 serial port support
 #
+# CONFIG_SERIAL_MAX310X is not set
 # CONFIG_SERIAL_UARTLITE is not set
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
@@ -1600,7 +1612,6 @@ CONFIG_HW_RANDOM_AMD=y
 CONFIG_HW_RANDOM_VIA=y
 CONFIG_HW_RANDOM_VIRTIO=y
 # CONFIG_HW_RANDOM_XIPHERA is not set
-# CONFIG_APPLICOM is not set
 # CONFIG_DEVMEM is not set
 # CONFIG_NVRAM is not set
 # CONFIG_DEVPORT is not set
@@ -1785,6 +1796,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_K10TEMP is not set
 # CONFIG_SENSORS_FAM15H_POWER is not set
 # CONFIG_SENSORS_APPLESMC is not set
+# CONFIG_SENSORS_APPLESMC_T2 is not set
 # CONFIG_SENSORS_ASB100 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_CHIPCAP2 is not set
@@ -1824,6 +1836,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_LTC4260 is not set
 # CONFIG_SENSORS_LTC4261 is not set
 # CONFIG_SENSORS_LTC4282 is not set
+# CONFIG_SENSORS_LTC4283 is not set
 # CONFIG_SENSORS_MAX127 is not set
 # CONFIG_SENSORS_MAX16065 is not set
 # CONFIG_SENSORS_MAX1619 is not set
@@ -1879,6 +1892,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_DME1737 is not set
 # CONFIG_SENSORS_EMC1403 is not set
+# CONFIG_SENSORS_EMC1812 is not set
 # CONFIG_SENSORS_EMC2103 is not set
 # CONFIG_SENSORS_EMC2305 is not set
 # CONFIG_SENSORS_EMC6W201 is not set
@@ -2073,7 +2087,6 @@ CONFIG_SCREEN_INFO=y
 CONFIG_VIDEO=y
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_AGP is not set
-# CONFIG_VGA_SWITCHEROO is not set
 CONFIG_DRM=y
 
 #
@@ -2114,7 +2127,6 @@ CONFIG_DRM_PANEL_BRIDGE=y
 # Display Interface Bridges
 #
 # CONFIG_DRM_I2C_NXP_TDA998X is not set
-# CONFIG_DRM_ANALOGIX_ANX78XX is not set
 # end of Display Interface Bridges
 
 # CONFIG_DRM_ETNAVIV is not set
@@ -2148,6 +2160,7 @@ CONFIG_DRM_PANEL=y
 # CONFIG_DRM_VGEM is not set
 CONFIG_DRM_VIRTIO_GPU=y
 CONFIG_DRM_VIRTIO_GPU_KMS=y
+CONFIG_VIRTIO_GPU_NV=y
 # CONFIG_DRM_VKMS is not set
 # CONFIG_DRM_VMWGFX is not set
 # CONFIG_DRM_XE is not set
@@ -2166,6 +2179,7 @@ CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
 # CONFIG_BACKLIGHT_AW99706 is not set
 # CONFIG_BACKLIGHT_KTZ8866 is not set
+# CONFIG_BACKLIGHT_MAX25014 is not set
 # CONFIG_BACKLIGHT_APPLE is not set
 # CONFIG_BACKLIGHT_QCOM_WLED is not set
 # CONFIG_BACKLIGHT_SAHARA is not set
@@ -2242,6 +2256,7 @@ CONFIG_HID_GENERIC=y
 # CONFIG_HID_MAGICMOUSE is not set
 # CONFIG_HID_MALTRON is not set
 # CONFIG_HID_MAYFLASH is not set
+# CONFIG_HID_RAKK is not set
 # CONFIG_HID_REDRAGON is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
@@ -2253,7 +2268,6 @@ CONFIG_HID_GENERIC=y
 # CONFIG_HID_PICOLCD is not set
 # CONFIG_HID_PLANTRONICS is not set
 # CONFIG_HID_PXRC is not set
-# CONFIG_HID_RAPOO is not set
 # CONFIG_HID_RAZER is not set
 # CONFIG_HID_PRIMAX is not set
 # CONFIG_HID_SAITEK is not set
@@ -2322,7 +2336,6 @@ CONFIG_RTC_MC146818_LIB=y
 CONFIG_SYNC_FILE=y
 CONFIG_UDMABUF=y
 # CONFIG_DMABUF_DEBUG is not set
-# CONFIG_DMABUF_SELFTESTS is not set
 # CONFIG_DMABUF_HEAPS is not set
 # end of DMABUF options
 
@@ -2809,6 +2822,8 @@ CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO=y
 # CONFIG_INIT_STACK_NONE is not set
 # CONFIG_INIT_STACK_ALL_PATTERN is not set
 CONFIG_INIT_STACK_ALL_ZERO=y
+CONFIG_CC_HAS_SANCOV_STACK_DEPTH_CALLBACK=y
+# CONFIG_KSTACK_ERASE is not set
 # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
 # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
 CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
@@ -2829,7 +2844,9 @@ CONFIG_CC_HAS_ZERO_CALL_USED_REGS=y
 # CONFIG_BUG_ON_DATA_CORRUPTION is not set
 # end of Hardening of kernel data structures
 
+CONFIG_CC_HAS_RANDSTRUCT=y
 CONFIG_RANDSTRUCT_NONE=y
+# CONFIG_RANDSTRUCT_FULL is not set
 # end of Kernel hardening options
 # end of Security options
 
@@ -2841,6 +2858,7 @@ CONFIG_BINARY_PRINTF=y
 #
 # CONFIG_PACKING is not set
 CONFIG_BITREVERSE=y
+CONFIG_GENERIC_BITREVERSE=y
 CONFIG_GENERIC_STRNCPY_FROM_USER=y
 CONFIG_GENERIC_STRNLEN_USER=y
 CONFIG_GENERIC_NET_UTILS=y
@@ -2929,9 +2947,7 @@ CONFIG_DEBUG_INFO_NONE=y
 # CONFIG_DEBUG_INFO_DWARF5 is not set
 CONFIG_FRAME_WARN=1280
 # CONFIG_STRIP_ASM_SYMS is not set
-# CONFIG_READABLE_ASM is not set
 # CONFIG_HEADERS_INSTALL is not set
-# CONFIG_DEBUG_SECTION_MISMATCH is not set
 # CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 # CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set
 CONFIG_OBJTOOL=y
@@ -3000,6 +3016,8 @@ CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
 CONFIG_HAVE_ARCH_KFENCE=y
 # CONFIG_KFENCE is not set
 CONFIG_HAVE_ARCH_KMSAN=y
+CONFIG_HAVE_KMSAN_COMPILER=y
+# CONFIG_KMSAN is not set
 # end of Memory Debugging
 
 # CONFIG_DEBUG_SHIRQ is not set
diff --git a/build/kernel/nestri.fragment b/build/kernel/nestri.fragment
index c9508073..c0fdc05b 100644
--- a/build/kernel/nestri.fragment
+++ b/build/kernel/nestri.fragment
@@ -13,6 +13,8 @@
 # ── Gaming needs ─────────────────────────────────────────
 # NTSYNC is a great improvement over fsync and esync approaches.
 CONFIG_NTSYNC=y
+# Performance CPU governor
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
 
 # ── Controllers ──────────────────────────────────────────
 # A controller of a family the box can rebuild is made here as the device
@@ -157,10 +159,47 @@ CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_PREEMPT_DYNAMIC=y
 CONFIG_LRU_GEN=y
 CONFIG_LRU_GEN_ENABLED=y
-CONFIG_TRANSPARENT_HUGEPAGE=y
-CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
 CONFIG_PSI=y
 
+# Huge pages for every anonymous mapping that can have one, not only those that
+# ask. Games map large, long-lived heaps and never call madvise() for them, so
+# madvise-only would give them none, and a guest's TLB misses are the dearer
+# kind: each one walks two page-table levels.
+CONFIG_TRANSPARENT_HUGEPAGE=y
+CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
+# CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set
+
+# The CachyOS scheduler and block-layer additions. The tree defaults these on,
+# but they are tree patches, so a different tree would quietly lose them.
+CONFIG_CACHY=y
+# Wakeup placement: finds an idle CPU from cached bitmasks instead of scanning,
+# which the frame pipeline pays for on every few-millisecond wakeup.
+CONFIG_SCHED_POC_SELECTOR=y
+# Keeps one process's threads inside a single last-level-cache domain.
+CONFIG_SCHED_CACHE=y
+# ADIOS as the multiqueue default: latency-driven, and the root is virtio-blk.
+CONFIG_MQ_IOSCHED_ADIOS=y
+CONFIG_MQ_IOSCHED_DEFAULT_ADIOS=y
+
+# BBR3 as the default congestion control. It paces itself, so it needs no fq
+# qdisc, and it holds a steady rate on lossy links where cubic backs off.
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_BBR3=y
+CONFIG_DEFAULT_BBR3=y
+CONFIG_DEFAULT_TCP_CONG="bbr3"
+
+# ── CPU count ────────────────────────────────────────────
+# The per-CPU areas and cpumasks are sized for this at build time. No size tier
+# comes near it, and a distro-sized value only costs memory and cache.
+CONFIG_NR_CPUS=32
+
+# ── Thin-LTO ─────────────────────────────────────────────
+# Whole-kernel inlining across translation units, which matters most on the
+# syscall and scheduler paths. Needs clang and ld.lld, so scripts/kernel-build.sh
+# builds with LLVM=1. Thin rather than full: the link is parallel and does not
+# need tens of gigabytes of memory.
+CONFIG_LTO_CLANG_THIN=y
+
 # ── Undoing the minimal seed ─────────────────────────────
 # base.config descends from a size-minimised config with EXPERT on, and EXPERT
 # is what makes each of these promptable. Every one is `default y` (or the
@@ -173,9 +212,9 @@ CONFIG_PSI=y
 # guest allocates constantly: network buffers, GPU ioctls, io_uring, futexes.
 # CONFIG_SLUB_TINY is not set
 #
-# Without ADVISE_SYSCALLS, madvise() and fadvise() return ENOSYS. THP above is
-# madvise-only, so no user mapping could ever get a huge page, and allocators
-# could never hand memory back with MADV_DONTNEED or MADV_FREE.
+# Without ADVISE_SYSCALLS, madvise() and fadvise() return ENOSYS, so allocators
+# could never hand memory back with MADV_DONTNEED or MADV_FREE, nor ask for
+# (or refuse) a huge page for one mapping.
 CONFIG_ADVISE_SYSCALLS=y
 #
 # Without MEMBARRIER, Wine and the .NET runtime fall back to an mprotect() trick
@@ -220,3 +259,14 @@ CONFIG_JUMP_LABEL=y
 # What would change this: running two players' sessions on one box at the same
 # time, or anything of value living inside the guest. Neither is true today.
 # CONFIG_CPU_MITIGATIONS is not set
+
+# The rest of what a general-purpose distro config pays for, off for the same
+# reason: one tenant, no untrusted code in the guest that the VM boundary does
+# not already contain. Pinned because a reseed from a distro config turns them
+# on, and each costs on the allocation, syscall or call path.
+# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
+# CONFIG_SLAB_FREELIST_HARDENED is not set
+# CONFIG_SLAB_FREELIST_RANDOM is not set
+# CONFIG_STACKPROTECTOR is not set
+# CONFIG_SCHED_STACK_END_CHECK is not set
+CONFIG_DEBUG_INFO_NONE=y
diff --git a/build/scripts/kernel-build.sh b/build/scripts/kernel-build.sh
index 7c0ee9c2..0c037958 100644
--- a/build/scripts/kernel-build.sh
+++ b/build/scripts/kernel-build.sh
@@ -170,6 +170,19 @@ grep -qx 'obj-$(CONFIG_VIRTIO_GPU_NV) += nvgpu/' drivers/gpu/drm/Makefile \
     || sed -i '/^obj-\$(CONFIG_DRM_VIRTIO_GPU) += virtio\/$/a obj-$(CONFIG_VIRTIO_GPU_NV) += nvgpu/' \
         drivers/gpu/drm/Makefile
 
+# ── Toolchain ───────────────────────────────────────────
+# Thin-LTO is clang's, and whether it is offered at all is decided when Kconfig
+# runs: HAS_LTO_CLANG is false under gcc, and olddefconfig would then drop
+# LTO_CLANG_THIN without a word. So LLVM=1 goes to every make below, config
+# steps included, and the tools are checked before any of it starts.
+for tool in clang ld.lld llvm-ar llvm-nm llvm-objcopy llvm-strip; do
+    command -v "${tool}" >/dev/null || {
+        echo "kernel: ${tool} not found; the kernel is built with clang for thin-LTO" >&2
+        exit 1
+    }
+done
+make_args=(LLVM=1)
+
 # ── Config ──────────────────────────────────────────────
 # A fresh tree has no .config. The seed is a known-good minimal config that
 # olddefconfig migrates to whatever version the tree is at; it only saves a
@@ -184,7 +197,7 @@ echo "kernel: merging kernel/nestri.fragment"
 # -m merges without running a config target, so olddefconfig resolves
 # dependencies once, in one place.
 ./scripts/kconfig/merge_config.sh -m .config "${FRAGMENT}" >/dev/null
-make olddefconfig >/dev/null
+make "${make_args[@]}" olddefconfig >/dev/null
 
 # ── Verify the fragment actually took ───────────────────
 # merge_config.sh warns about overridden symbols but exits 0, and olddefconfig
@@ -217,7 +230,6 @@ echo "kernel: all ${total} fragment entries hold"
 # and gcc applies those as a mask over -march regardless of flag order, so the
 # kernel gets v3's integer ISA (BMI2, LZCNT, MOVBE) and its scheduling model
 # and never touches a vector register.
-make_args=()
 if [[ -n "${KERNEL_MARCH:-}" ]]; then
     make_args+=("KCFLAGS=-march=${KERNEL_MARCH}")
     echo "kernel: building with -march=${KERNEL_MARCH}"