“On Hubris, if you break a system call’s preconditions, your task is immediately destroyed with no opportunity to do anything else.”
Oxide’s Hubris kernel doesn’t return polite error codes. Pass it a bad pointer or an out-of-range task index and it kills you on the spot, and REPLY_FAULT lets a server do the same to a misbehaving client. The design keeps correct programs from paying code size and runtime for errors they can’t hit. Most operating systems spend their lives negotiating with broken callers. Hubris just shoots them.