That does sound interesting! It always seemed odd to me that my whole machine pays the cost for spectre mitigation when the only processes that need it (to me)

That does sound interesting! It always seemed odd to me that my whole machine pays the cost for spectre mitigation when the only processes that need it (to me) are JavaScript vms in the browser. Even my electron apps don't need it, they have access to the filesystem which is far better than any spectre attack. You should have a syscall to opt into spectre protections. Like "I run untrusted code". Then the OS scheduler can treat it differently, keep the hyperthread only for other untrusted processes like that, flush the cache when scheduling something else on that core, etc.