diff --git a/FABRIC-2.md b/FABRIC-2.md index c08defc..74c088f 100644 --- a/FABRIC-2.md +++ b/FABRIC-2.md @@ -774,10 +774,27 @@ together. **F.3** is the condensed punch list distilled from both. 4, the shared fleet-capacity counter can already reach `HEARTBEAT_INFERENCE_FREQUENCY` up to ~4× sooner in wall-clock terms than a single VM's own heat-inference gate — backwards from §22.4's required 1000:1 separation, confirmed by this document's own §12 Q5 investigation - above. `STADIUM_CAPACITY_TICK` already exists as a Kconfig symbol, default matching the - cited precedent, but is never read by any code path. **Question for Bob:** wire it in for - real (giving Hera her own slower cadence independent of per-VM tick counts), or resolve the - ordering some other way? + above. + + **Correction 2026-08-15 — the fix must stay inside the one-clock rule (`FABRIC.md` §16.4 + GAP-A1, §17.1 "two measures, one clock... this does not mean two clocks").** `fleet_ + heartbeat_tick_count` (`capsule_vm_physics.c:157`) is a single counter, incremented once + per call to `vm_physics_heartbeat_tick()`, which itself only ever fires from inside the + execution-paced `vm_tick()` (`vm_runtime.c:141`) — never from a hardware timer. So there is + only one clock here, exactly as ruled; the earlier framing of this item ("give the capacity + tick its own named constant... independent of per-VM tick counts") was worded ambiguously + enough to read as "add a second clock," which is not the fix and must not be built as one. + The actual defect is narrower: `vm_tick()` calls `vm_physics_heartbeat_tick()` from *every* + live VM's own dispatch (deliberate, `vm_runtime.c:126-138`'s own comment explains why — the + fleet-capacity signal needs to reflect aggregate activity, not just Hera's), so `fleet_ + heartbeat_tick_count` advances on the fleet's *combined* stream while `HEARTBEAT_INFERENCE_ + FREQUENCY` was written assuming a single VM's stream. Same one counter, same one clock — + the threshold compared against it just doesn't account for multiple VMs feeding it at once. + **Question for Bob:** the fix is to give `STADIUM_CAPACITY_TICK` a larger *threshold value* + checked against the existing `fleet_heartbeat_tick_count` (still one clock, one counter — + just a bigger divisor, e.g. scaled by the live VM count so it restores something closer to + the required 1000:1 separation), not a second tick source. Wire it in that way, or resolve + the ordering some other way? **Closed-by-ruling, not reopened this pass** (each already has a recorded "flag and leave" decision from Captain Bob — reversing that without being asked would be exactly the @@ -795,7 +812,9 @@ unreachable NULL-write, `m5_time_trust`/`m5_variance` dead fields. **Code / actionable — pending Captain Bob's call or Artemis landing:** -- [ ] §12 Q5 — wire `STADIUM_CAPACITY_TICK` for real, or resolve the ordering some other way? +- [ ] §12 Q5 — give `STADIUM_CAPACITY_TICK` a real threshold against the existing + `fleet_heartbeat_tick_count` (one clock, bigger divisor — not a second tick source), or + resolve the ordering some other way? - [ ] 4.4s → 1.11 → 4.3 → §17.4 chain — no ruling needed, just unstarted work blocked on ACL Phase 8 (identity storage), out of this pass's scope - [ ] 5.1 (DoE re-run) + ACL-RWT re-measurement — run now, or wait for Artemis (recommended)?