Review date: 2026-09-16 Reviewed source: /home/travis/ProjectAmp2/computedriven commit 01031e697af55c0f557fd588cbf60d9255887f95 Decision: HOLD the official Tier A battery. REVISE the kernellet-cost contract before writing its code.
Stage 0.1 repairs three of the four original blockers cleanly and makes the fourth much better: semantic refusals no longer masquerade as progress, counter domains are separated, and the current ComputeDriven row is honestly named computedriven-policy. The armed deadline also prevents progress from being credited after the window. Independent review found one remaining boundary error in that deadline model, two official-runner omissions, and a quadratic metric path that is too costly for the declared official duration.
Fable owns every source change below. Codex should review the resulting commit and evidence; Codex should not edit the benchmark source.
The tree was clean at the reviewed commit.
The independently rerun quick controls reported CONTROLS HELD for C1–C9 across 124 runs.
tools/fcb_battery.py --selftest passed.
tools/fcb_battery.py --preflight refused this desktop host and ran no battery. It correctly reported the absent reference, current load/foreign workload, scratch/Cargo placement, and pinned-core activity.
The complete repository guard suite passed: ALL GUARDS PASS. Its kernellet census re-derived 240 external witnesses held and left receipts/ byte-identical.
The software context-switch event is now null with EACCES rather than a misleading zero; uniform rusage switching is nonzero; Linux is excluded from the user-only instruction frontier.
ready_to_progress now contains only successful transitions; resolution/refusal populations and reasons are separate; closed-loop exact gap maxima and unserved tails are represented.
The row is consistently named computedriven-policy and its subject text says it is a cd-core policy adapter, not the production kernellet.
Residency moves from a transition that completes after the deadline are rolled back in the Linux, Go and ComputeDriven policy rows.
The retained smoke remains non-evidentiary, as required.
The shared C path decides whether an entity may begin by comparing the previous transition's completion with the deadline (fcb/c/fcb.h:118-122). Linux and Seastar call that check before popping/serving, but it does not read the current clock. The transition runs first; only its completion time is read (fcb/c/fcb.h:170-186). Go has the same shape (fcb/go/fcb_go.go:375-435), and the ComputeDriven policy adapter reads time only after step (fcb/cd/src/main.rs:268-310).
That distinguishes “completed before” from “completed after,” but it cannot distinguish:
begun before the deadline and completed after it — genuinely in flight at the deadline; from
begun after the deadline — never in flight during the measurement window.
An adversarial review run delayed every tick-0 closed-loop event until approximately 300 ms after its nominal instant, while the armed window was 200 ms. Because the demand arrived about 100 ms after the deadline, every transition caused by it necessarily began after the deadline. Observed results:
| row | transitions executed after late demand arrived | reported inflight_at_deadline | admitted |
|---|---|---|---|
| Linux | 31 | 31 | 0 |
| Go | 0 | 0 | 0 |
| BEAM | 0 | 0 | 0 |
computedriven-policy | 1 | 1 | 0 |
| Seastar | 32 | 32 | 0 |
The source was intentionally late, so these rows would be rejected as official results. The run is a control that proves the implementation's boundary invariant is false. An on-time worker preempted before its next start can reach the same path after the deadline.
No progress or migration credit leaked. Physical instructions/cycles did leak because the perf events remain enabled through process exit, including this work and cleanup. Therefore the official measurement still does not have one common physical-cost window.
The runner executes both runs at tools/fcb_battery.py:258-259, derives a scorecard and gates only r2 at lines 262-269, then computes the marginal from both runs at lines 266-268. It does not run the deadline, source-lateness or counter checks on r1. Unlike the development smoke, it also does not replay C2 for either raw run.
A late, corrupt, post-deadline or counter-invalid B run can therefore enter the numerator and denominator of marginal_insns_per_admitted while the 2B row passes. The stored B JSON does not compensate for accepting the derived slope.
For each sampled closed-loop completion, tools/fcb_metrics.py:113 searches the row list with rows.index, slices everything before it, then scans that slice with any. Only a seen_closed flag is needed. On the independently retained 200 ms Go control row, metric derivation processed 61,920 sample records for 3,960,424 admitted transitions and took 2.536 seconds of CPU. The official runner declares 2 s and 4 s windows and five repeats; the current path grows approximately quadratically with closed-loop samples and can dominate the campaign.
This is a tooling scalability blocker rather than a semantic error in the resulting metric.
The split between scheduler outcome and real-kernellet transition cost is correct. The subject path is also good: the actual cd-kernellet ELF performs many transitions inside one BENCH command, so host pipe cost is not charged per transition.
The contract is not ready for implementation for two reasons:
It names “R2's 201 witnesses” and identifies tools/kernellet_abi.py as the battery. At the reviewed commit, tools/kernellet_census.py builds the external batteries using kernellet_abi.py, and the guarded receipt contains 240 witness objects, all held, across six batteries. The contract must name the current exact gate rather than a stale total.
C, Go, Erlang and the smaller Rust attach/detach loops cannot pass the kernellet's complete external battery. That battery includes BOOT, table bounds, finalization, fencing, authority evidence, custody and multi-context behavior that those comparators do not implement. A shim that supplies those mechanisms would test the shim, not the transition loop.
Use two different gates and name them honestly:
The production kernellet subject must pass the full current census/external battery unchanged at the exact measured commit.
Every measured row must pass one new shared class-S transition-vector suite limited to the semantics actually priced: possession dispatch, generation/transition evolution, copy-in/copy-out, refusal without losing the original, and the common digest. Include a skip-copy-out mutant that this suite catches.
The marginal-subtraction prose also overstates what arithmetic guarantees. K/2K subtraction is intended to cancel costs fixed per process at constant n; it does not by itself prove that first-touch, JIT, runtime services or non-proportional GC canceled. Keep F-KC-3's K/2K/4K linearity check and rewrite the fixed-cost list as hypotheses validated by that check. If a row is nonlinear, report the raw points and withhold the marginal. Phrase the cross-language counter column as user-domain transition-loop cost, since kernel runtime work remains outside that domain.
Correct the statement that CLOCK_MONOTONIC is “never ... slewed.” It is not discontinuously changed by wall-clock setting, but its rate can be adjusted. The benchmark needs a shared monotonic clock domain; it does not need the stronger and false statement.
For every timed transition, record/read a monotonic t_begin immediately before any semantic mutation, LONG work, residency move, digest fold or intent consumption that cannot be restored.
If t_begin > deadline, execute nothing. Do not call it in flight, do not mutate the lineage or digest, do not add a served sample, and leave the intent/unserved accounting coherent.
If t_begin <= deadline < t_complete, report exactly one inflight_at_deadline for that entity. It remains uncredited and ends serving.
If t_complete <= deadline, account normally.
Keep migration rollback for an uncredited completion.
Rename comments and fields if necessary so “inflight” means what it says.
Add a C7 start-boundary control that arms a short window and releases demand only after it. It must require served = 0, inflight_at_deadline = 0, admitted = 0, no semantic/digest change, and no moves on all five rows. Add a mutant that uses the previous-completion check so the new control proves it can fail.
For physical counters, add an independent parent-side cutoff at the armed absolute deadline. Disable the perf group at that deadline and record the intended cutoff plus actual disable lateness. The official gate must reject a cutoff outside a predeclared tolerance. Process cleanup, an in-flight tail after the deadline and result serialization must not enter the window's instruction/cycle totals. Keep cleanup duration as a separate diagnostic.
Refactor the official runner so one raw-run audit is applied independently to B and 2B before a marginal can exist. For each raw run require:
source lateness within the bound;
start/completion window invariants;
C2 replay success;
conservation success;
counter availability/domain validity and no multiplexing;
the physical-counter cutoff gate.
Any failure rejects the whole B/2B pair and its block; no marginal or frontier cell may be emitted from it. Preserve both audits in the receipt. Add runner self-tests in which only B violates each relevant gate, and require the pair to be rejected.
Replace the rows.index/prefix-slice scan with per-Locus state such as seen_closed. Audit the rest of compute for repeated scans over growing sample lists. Preserve byte-for-byte metric results on the existing C8 fixture and representative raw files. Add a scalability exercise large enough to expose accidental quadratic behavior; report its record count and runtime as tooling evidence, never as a system result.
Do not write kernellet-cost benchmark code yet. Revise the contract as described above:
current full kernellet census gate and exact dynamically derived witness total;
separate cross-language class-S transition-vector gate;
precise subject/comparator layouts;
fixed-cost cancellation stated as a tested hypothesis;
K/2K/4K nonlinearity handling;
user-domain wording for cross-language counters;
no claim that an interrupt return retires a user instruction unless the contract cites direct evidence or demonstrates it with a control.
Return the revised contract for Codex review before implementing the campaign.
Replace “never stepped or slewed” everywhere with accurate shared-monotonic wording.
Fix the three git show --check findings in docs/fcb-stage0-review-2026-09-16.md (two trailing-space lines and the extra final blank line).
Update the stage record so it does not claim the late completion is necessarily in flight without a start timestamp.
Codex may authorize a dedicated-host Tier A run only when:
C1–C9 and the new start-boundary mutant/control hold independently.
Demand released after the deadline produces zero served/inflight work on every row.
Both B and 2B receive and retain identical raw-run audits; a B-only mutant rejects the pair.
Physical counters are cut off at the armed deadline within the declared tolerance.
C2 replay and conservation are checked on every official raw run.
Metric derivation is linear and practical at official sample volumes.
Repository guards pass, git show --check is clean, and the tree is clean at an exact commit.
The kernellet-cost campaign remains a separate gate. Its revised contract must be accepted before its implementation begins, and its results must never be merged into the scheduler-outcome frontier as one synthetic winner claim.
Benchmark development: proceed with the bounded stage-0.2 repair.
Official Linux/Go/BEAM/Seastar versus `computedriven-policy` run: hold.
Real `cd-kernellet` cost code: hold pending contract revision and review.
Existing stage-0.1 performance numbers: development diagnostics only.