Status: model for the round opened on the R7 adjudication. Rules nothing; receipts/R7.1-OPEN.md is the contract. Every numeral here is a definition or a prediction, never a measurement.
R7 answered given a ready set, how should it be multiplexed? and its most artificial part was no longer the floor: it was the harness declaring, each round, which Loci are ready. R7.1 asks the next question:
When readiness itself arrives asynchronously, can events be turned into bounded Locus progress without falling back into thread scheduling?
Three scheduling control dimensions — selection, residency,
placement — given a fixed atomic-transition and ready/admissible interface (R7 adjudication). Events feed the ready set; they are not a fourth dimension.
Readiness is intent the floor does not know. The floor knows
possession, not demand; whether a Locus has something to do is decided above it and presented to it as a command.
A semantic transition is never split, and therefore **a transition
never waits for an event**. A Locus that needs an event is simply not ready. Waiting is a readiness fact, not a suspended execution: no stack is held, no continuation exists, nothing is parked mid-transition.
**Migration is not progress; a refusal is counted; an event executes
nothing.**
| term | definition | what it is not |
|---|---|---|
| event | a datum addressed to one Locus with an arrival instant: (locus, kind, seq, t_arrival); kinds in this pass: MESSAGE (a packet or a model result), TIMER (a deadline fires), DEPENDENT (another Locus's committed transition), COMPLETION (an external operation finished) | not a command; an event never carries an instruction to execute |
| event source | whatever produces events with real arrival instants: in this pass a separate process writing a seeded trace to a pipe with inter-arrival delays, and the floor's own outcome frames for DEPENDENT | not the harness's round loop |
| mailbox | the per-Locus bounded queue of admitted events, depth M; the Locus is ready iff its mailbox is non-empty and its next intended transition is admissible — that conjunction is the one definition, used everywhere | not a thread's stack; holds intent, never execution state |
| consumption | an admitted event is consumed by exactly one SUCCESS of the transition it intended; on a refusal the event remains in the mailbox unless the refusal is explicitly terminal for that event (named as such) — a floor refusal never becomes a silent event drop | |
| readiness admission | the act of accepting an event into a mailbox; refused with a named reason when the mailbox is full (MAILBOX_FULL, the backpressure signal) or the Locus is terminal; every event seq eventually receives a disposition — ACCEPTED or MAILBOX_FULL — on the return path to the source | never a silent drop |
| the rate pipeline (five stages, one window) | λ_offered (events the source scheduled per second) → λ_written (written into the transport) → λ_delivered (reaching admission) → λ_admitted (accepted into mailboxes) → λ_progress (producing successful transitions); `μ_capacity` is reserved for the independently calibrated service ceiling and is never one of the five. All five are computed over one observation window (the source-active window; the drain is in the counts, not the rates); cumulative counts are the conservation proof. Healthy: the five ≈ equal. Mailbox saturation: λ_admitted < λ_delivered, admission refusals ≈ λ_delivered − λ_admitted, λ_progress ≈ λ_admitted. Transport limited: λ_written < λ_offered or λ_delivered < λ_written — the channel delayed the source's writes, and the run is labelled source/transport limited, never a scheduler result. (Canonicalized from the four-rate form after the first receipt's adjudication, §11; ERRATA E8.) | not four rates over two windows: the first receipt's offered/written were over the source window and delivered/admitted/progress over the run wall, and rates on different windows are never said to "agree" |
| event-to-progress latency | t_progress − t_arrival in µs (and in event-loop polls) from the event's arrival at the source's pipe to the admitted transition it intended | R7's round-based latency measured from a declaration; this one is measured from an arrival |
| poll | one pass of the event loop: drain the event fds, admit into mailboxes, then one R7 scheduling round over the ready set | not a tick; a poll with no events and no ready Locus does no floor work |
active polls per admitted (active_polls_per_admitted) | event-loop iterations that admitted at least one event or served at least one Locus, divided by admitted transitions | not wakeups: while the ready set is non-empty the loop never blocks |
blocking wakeups per admitted (blocking_wakeups_per_admitted) | returns from a blocking poll() entered with an empty ready set, divided by admitted transitions — the replacement for "idle thread" accounting: a quiet World costs zero floor work while quiet and one wakeup per externally observable arrival batch — not per Locus and not per event (§11; E3's 32-event batch is one wakeup, E8's one-event-per-batch trace is the special case in which batch = event) | not "one wakeup per arriving event" — that was the pre-adjudication wording (ERRATA E8) |
| saturation | under λ_offered > μ a bounded mailbox does not grow without bound: occupancy → M, admission refuses, λ_admitted → μ, and the latency of accepted events stays bounded — that is what backpressure is for. Overload must remain visible as some combination of occupancy at M, refusal_amplification > 0, and source/transport backpressure; Little's law L ≈ λ_admitted × W is the consistency check on the stable admitted queue, with L ≤ M | not "the queue grows without bound" |
| dependent readiness | an event produced by a transition of Locus A that the floor accepted and whose outcome was emitted, making Locus B ready; in this pass the outcome frame is the event, and the R3 egress frame on fd 3 is named as the production path. "Committed" here means floor-accepted with its outcome emitted, never durable in history or anchor — durably-anchored dependency is R7.3's | not a call; A does not execute B |
event sources ───► readiness admission ───► READY SET ───► selection / residency / placement ───► atomic transition ───► outcome / evidence
(pipe, timer, (bounded mailbox; │
completion) MAILBOX_FULL is a └──► DEPENDENT event
refusal, never a drop) (back to admission)Two rules make this not thread scheduling:
**An event may change readiness-layer state — mailbox contents and
ready-set membership — but it changes no Locus semantic state and executes no floor command.** No event handler runs; the only code that touches a Locus is a floor command chosen by the R7 scheduler.
Nothing blocks. A thread would sit in recv() holding its stack;
here a Locus without a mailbox entry is absent from the ready set and costs nothing until an event arrives. The event loop blocks in poll() on the source fds only when the ready set is empty — the one place where waiting is allowed, and it is the harness's, not a Locus's.
| the thread-scheduling shape | why it is refused here |
|---|---|
| resume Locus at instruction k when its event arrives | there is no k: a transition is whole; the event makes the next transition admissible |
| a per-Locus thread parked in a syscall | a parked Locus holds 317 bytes in the parking store and no stack |
| an event handler that executes the transition | events are data; execution is the scheduler's choice, priced by R7's metrics |
| dropping events under load | admission refuses with MAILBOX_FULL; the source sees it; refusal amplification counts it |
| readiness declared by the harness | after this pass the ready set is derived only from admitted events (F147) |
The R7 arms are unchanged — RR-FAIR, AGE-FIRST, CLOCK-AGE(q, A), and HOT-RESIDENT as the control — with readiness coming from mailboxes instead of a declaration. Two knobs are added: mailbox depth M and the batched-visit q from the READYRUNQ preflight (a visit may serve up to q complete transitions from one mailbox). Neither is tuned; both are swept and reported.
| trace | arrivals |
|---|---|
| STEADY-λ | seeded exponential inter-arrivals at a stated λ per Locus, addressed uniformly; below, at, and above the measured capacity |
| BURSTY | on/off: a burst of B events to one Locus in one poll, then silence; tests mailbox depth and refusal at admission |
| TIMER | each Locus has a period; TIMER events are generated by the harness clock, not by the source process; tests latency from a known instant |
| DEPENDENT | a chain: Locus i's committed DETACH makes Locus i+1 ready (the outcome frame is the event); tests hop latency and that nothing executes on the event's behalf |
| MIXED | STEADY plus a DEPENDENT chain plus a TIMER set, the shape a real World presents |
R7's set, with the canonical names, plus:
| metric | class |
|---|---|
| event-to-progress latency p50 / p99 / p99.9 (µs, from arrival) | semantic, primary |
events admitted · refused at admission (MAILBOX_FULL) · in mailboxes (mean, max) | semantic / backpressure, primary |
| dependent-hop latency (µs per hop, chain length) | semantic, primary |
active_polls_per_admitted · blocking_wakeups_per_admitted (wakeups counted per arrival batch) | physical price, primary |
saturation: mean occupancy vs λ, and the λ at which occupancy reaches M and admission begins to refuse (a bounded mailbox never grows without bound; F148) | diagnostic and control (Little's law, L ≤ M) |
| polls with no work | diagnostic |
F142 an event is lost without a refusal: admitted + refused ≠ produced, or a mailbox overflow is silent (must not)
F143 a Locus with an admitted event never becomes ready, or becomes ready with an empty mailbox (must not)
F144 event-to-progress latency grows without bound under a fair arm at an arrival rate below capacity (must not)
F145 a DEPENDENT event reaches the dependent Locus before the source transition's outcome is committed (must not; R3's ordering)
F146 anything executes a floor command on an event's behalf outside the scheduler's round (must not; structural)
F147 the ready set contains a Locus with no admitted event (harness-declared readiness survives) (must not)
F148 overload is hidden: λ_offered stays above the measured service capacity for the observation window, yet
neither mailbox occupancy at M, nor admission refusals, nor source/transport backpressure accounts for the
excess demand (bounded latency of ACCEPTED events under overload is NOT a failure; it is what backpressure buys)
(must not)
F151 an admitted event is dropped by a floor refusal: refusal_amplification rises while the mailbox count and the
disposition accounting (produced = accepted + refused + transport_pending) no longer balance (must not)
F149 the production image anchor moves (must not; F86)
F150 the starving control fails to starve under events: HOT-RESIDENT serves a parked Locus's event while
residents have mailbox entries (predicted not to happen; the control)Below capacity, RR-FAIR and AGE-FIRST bound event-to-progress latency
by one poll plus the round's length; CLOCK-AGE by A polls for a cold Locus; HOT-RESIDENT starves parked Loci exactly as in R7 (F150).
At λ_offered above capacity every arm's mailboxes fill to M,
admission refuses, λ_admitted → μ, the latency of accepted events stays bounded, and L ≈ λ_admitted × W with L ≤ M; overload is visible in occupancy and refusals, and a run in which the channel throttled the source is labelled transport limited, not a scheduler result.
BURSTY with B > M refuses B − M events at admission on the first
poll; with q ≥ M one visit drains the burst.
DEPENDENT chains have hop latency of one poll plus the scheduler's
round; nothing executes on the event's behalf; the chain's total is linear in its length.
Active polls per admitted approach `1 / (transitions served per
poll) and fall as q and the ready-set size rise; blocking wakeups per admitted approach 1 / (events per burst × transitions per event)`; a quiet World costs zero floor commands per poll and one blocking wakeup per arriving event. (Prediction kept as written; measured and canonicalized in §11 as one wakeup per arrival batch — E8's trace made batch = event; ERRATA E8.)
The R7 cost decomposition holds with one added term, admission, which
is a harness cost in this pass and is reported.
Real event sources (Motor completions, Fabric frames on fd 3 from a
second floor, timers from the kernel) instead of a trace process.
Cross-floor placement driven by mailbox occupancy (R7.2).
The durable path per policy (R7.3), and MAILBOX_FULL as a durable
refusal.
Priorities and deadlines as admission policy, not as scheduling
dimensions.
The direction was accepted strongly; the contract was amended before implementation, and the amendments are in place above:
Rule 1 says what an event may change: readiness-layer state (mailbox,
ready set), never Locus semantic state, never a floor command (§2).
F148 rewritten: with a bounded mailbox and admission refusal,
bounded latency of accepted events under overload is the design working, not saturation hidden. The invariant is that overload stays visible — occupancy at M, refusals, or transport backpressure — and Little's law is the check on the stable admitted queue (L ≤ M), never a claim that a finite mailbox grows without bound (§1, §7).
Four rates separated so a ComputeDriven admission refusal is never
confused with a pipe throttling the source: λ_offered, λ_delivered, λ_admitted, μ_progress; a transport-limited run is labelled as such (§1). (The separation stands; the four-rate form was superseded by the five-stage pipeline on one window with `μ_capacity` reserved, §11, and §1 now carries that form — ERRATA E8.)
The refusal return path: the channel is bidirectional; every event
seq gets a disposition; produced = accepted + admission_refused + transport_pending at every instant and produced = accepted + admission_refused once drained (§1).
Transport backpressure made visible: scheduled source events, actual
writes, write delay, beside mailbox refusals and occupancy (E2).
"Wakeups" split into active_polls_per_admitted and
blocking_wakeups_per_admitted (§1).
Consumption semantics fixed before code: one SUCCESS consumes exactly
one event; a refusal leaves it unless explicitly terminal (F151); ready is the conjunction mailbox non-empty and next transition admissible everywhere (§1).
"Committed" in DEPENDENT means floor-accepted with its outcome
emitted; durably-anchored dependency is R7.3's (§1).
`q` is a residency quantum in complete semantic transitions — permit
a Locus up to q complete advances during this visit — the native analogue of a scheduler quantum. Swept, not defaulted: q = 16 is not the default until R7.1 has priced it in cold-Locus latency, oldest-ready age, fairness, burst response and dependent-event latency.
The preflight's sentence is narrowed: *the hot Lineage take/put is
paid per Locus visit rather than per semantic transition, so batching amortizes that context-movement cost across complete transitions; the preflight does not establish that every byte of the 309-byte transferable Locus state is moved once per visit* (the census sees 168- and 176-byte copies; the 309-byte object is core plus authority). The memcpy census is kept permanently: it separates necessary semantic work, necessary visit movement, and generated accidental movement.
BENCHZC is the positive control for cold-slot reachability, not a
fully corrected canonical SKEW-7/8 generator (its retained hot branch excludes slot 0 at count 64); R7.1's workloads do not depend on it.
The first receipt (R71-BATTERY-20260905T185910Z, 10/10) was not accepted as a receipt: the adjudication found a rig defect and two measurement-language issues, ordered a repair-only pass, and accepted the architecture. Standing after the ruling:
Accepted: asynchronous events can produce bounded Locus progress
without representing any Locus as a blocked or suspended thread — the frozen wording. Not "without a thread anywhere": the apparatus is Linux processes, a Python harness and select; the semantic property is that a Locus waiting for an event is not blocked execution, it is not-currently-ready. Events change readiness-layer state, floor commands happen only inside scheduler rounds, and no Locus carries a blocked stack or a partial transition. E0–E3, E5, E7–E9 accepted provisionally; E4 and E6 repair and rerun.
The timer defect (the rig, not the model): timer generation kept
minting deadlines during the drain after the declared window, so a slower-draining arm extended its own workload — CLOCK-AGE received about 26,000 TIMER events in E4 where the other arms received about 16,000, and E6's timer component ran past its 3 s window. The arms did not see the same workload. The repair gives generation an explicit horizon (timer_due < run_end; no new TIMER events during drain) with a witness that every arm's generated count equals N × duration / period and that no due instant lies at or beyond the horizon (ERRATA E6).
Backpressure, the standing definition (E2 accepted with it):
correct backpressure preserves accounting, bounds resource consumption, makes excess demand externally visible, and never turns overload into silent loss; for a policy that claims bounded progress, admitted-event latency must additionally stay within that policy's declared bound. Not merely "bounded latency": no hidden loss, bounded mailbox storage, explicit pressure (refusal, transport pressure, or both), and bounded progress for the policies that promise it — which is why HOT-RESIDENT, the starvation control, has no latency bound.
Two refusal amplifications. R7's refusal_amplification stays what
it is: floor transition refusals ÷ successful transitions. MAILBOX_FULL happens before the floor, so R7.1 adds admission_refusal_amplification = admission refusals ÷ events admitted (and admission_refusal_fraction = admission refusals ÷ events delivered). Admission is not a fourth scheduling dimension; it is another layer with its own physical price:
``text cost / semantic progress = floor transition + visit amortization + migration + floor-refusal amplification + admission + admission-refusal amplification + transport ``
The five-stage rate pipeline, replacing the four rates:
λ_offered (scheduled by the source) → λ_written (into the transport) → λ_delivered (reaching admission) → λ_admitted (into mailboxes) → λ_progress (producing successful transitions), with `μ_capacity` reserved for the independently calibrated service ceiling. R7.1 showed λ_written matters on its own. All five are computed over one observation window; cumulative counts are the conservation proof, and rates computed over different windows are never said to "agree" (the first receipt's offered/written were over the source-active window and delivered/admitted/progress over the whole run including drain).
Wakeups are per arrival batch. The standing wording: *a quiet World
performs zero floor work while no readiness arrives; a blocking wakeup occurs per externally observable arrival batch, not per Locus; E8's one-event-per-batch trace therefore measured one wakeup per event.* E3 is the counterexample: 32 events in one batch, one wakeup. Amortization now has three levels — one wakeup per event batch, one visit per ready Locus, up to q complete transitions per visit.
New unclaim: "zero floor commands while quiet" establishes the
absence of repeated floor execution as time passes — dormant Loci produce no floor transitions merely because time passes — and not that dormant Loci are computationally free regardless of population: memory, ready-set scan after a wakeup, event lookup at millions of Loci, cache effects and wakeup-to-selection complexity are unmeasured.
`q` stays swept, no default: it is a maximum semantic residency
quantum, never work the system is forced to invent (under a sparse workload transitions per visit stay near 1 at q = 16); only RR-FAIR got the full sweep, and dependent chains were not swept across every q. Adaptive q (by mailbox depth, age elsewhere, migration price, event kind, deadline pressure, locality) is named and not built.
R7.2 placement is next, after the repair pass holds, with one
question written before any placement algorithm: where does readiness live while a Locus moves? If each floor owned a mailbox, the duplication and currentness questions of R6 would return one layer up. The ruling: each Locus has one stable logical readiness home keyed by Locus id; placement moves the semantic Locus between floors and neither duplicates nor migrates the mailbox; during a move new events stay in the mailbox and the Locus is not serviced until the handoff resolves; after the move the placement pointer changes and the destination's next visit consumes the queued work. Admission policy, A, q, selection and residency are fixed during R7.2 so that only placement varies (RR-FAIR primary, selected cases repeated with CLOCK-AGE), and R7.2 derives migration_cost, placement_gain, break_even_transitions, move_amortization_horizon and `migration_regret` — a Locus moved again before the previous move's physical cost was amortized.