There are a few small features I would like to change about the Keykos kernel.
A solution that I thought of fairly recently would be to add an architected slot in the meter that serves as a limit on the number of processes below. It would be an up-down counter just as the CPU slot is a down counter. It would be cached just as the CPU counter is cached. Upon exhaustion, fork invocations would fail and the meter keeper invoked. See “meter” here.
This might solve another problem too; a covert signal receiver might use two real CPUs to time signals. This limit could limit hostile receivers to just one CPU. This is queasy as it presumes that you can identify potentially hostile receivers.