From ae673eb899cec3e42571e55b6e52be53ef334aaf Mon Sep 17 00:00:00 2001 From: Transaction Science Date: Wed, 14 Oct 2026 02:45:40 -0400 Subject: [PATCH] eoc-meter: a GPU rise the oracle saw is not one the probe must have seen `the_production_probe_hands_the_rule_what_the_oracle_reads` failed once on an otherwise green tree -- the only failure of that job across 309 commits: ("GPU Energy", 0) moved 1508467856154491 -> 1508467860032551 across the oracle's reads, but every one of the 20 samples the production probe took read [1508467856154491] The assertion behind it does not hold. The oracle's two reads *bracket* the probe's samples, so a rise it saw can fall entirely outside the probe's own window. GPU energy is activity-driven, not a clock: it rises only while the GPU works, so on a shared host another process's short burst lands between the oracle's first read and the probe's first sample as readily as inside it. The observed delta is about one tick's worth. One value is therefore no evidence of a sampler that is not sampling. The same block already reasons this way one branch over -- a rail that held across the bracket is reported with "freshness is NOT asserted on it" -- and sandbox-meter's equivalent prints its GPU-hold case rather than asserting it. This applies that reasoning to the case where the rail moved: the count of distinct values is reported either way, and nothing is asserted from it. Every other assertion is untouched, including the one that each handed sample lies within the oracle's bracket. What this gives up: a sampler that cached one reading and handed it back would no longer be caught here. The liveness tests are what cover a rail that does not advance (`the_liveness_probe_never_reports_a_frozen_rail_as_live`, `the_ioreport_meter_is_never_available_on_a_frozen_cpu_rail`). Restoring a sound version of this check means driving GPU work inside the probe's own window, so a rise is guaranteed to be there to see; that is a larger change than this one. Verified on the IOReport host: 17 of 17 `macos_ioreport` tests and all 80 eoc-meter lib tests pass. That run took the held branch, so it exercises the paths around this change rather than the rare case itself, which by construction cannot be forced. Co-Authored-By: Claude Opus 5 --- eoc/eoc-rs/crates/eoc-meter/src/lib.rs | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/eoc/eoc-rs/crates/eoc-meter/src/lib.rs b/eoc/eoc-rs/crates/eoc-meter/src/lib.rs index fa24bebeb..63bdd6965 100644 --- a/eoc/eoc-rs/crates/eoc-meter/src/lib.rs +++ b/eoc/eoc-rs/crates/eoc-meter/src/lib.rs @@ -3390,13 +3390,23 @@ mod macos_ioreport { handed.iter().filter_map(|s| s.iter().find(|(k, _)| k == key).map(|(_, v)| *v)).collect(); values.dedup(); if *lo != hi { - assert!( - values.len() >= 2, - "{key:?} moved {lo} -> {hi} across the oracle's reads, but every one of the {} samples the \ - production probe took read {values:?}: its sampler is not sampling", - handed.len() - ); - lines.push(format!("{}: moved {lo} -> {hi}, the probe read {} distinct values within it", key.0, values.len())); + // The oracle's two reads *bracket* the probe's samples, so a rise it + // saw can fall entirely outside the probe's own window. GPU energy + // rises only while the GPU works -- it is activity-driven, not a clock + // -- so on a shared host another process's short burst lands between + // the oracle's first read and the probe's first sample as easily as + // inside it. One value here is therefore no evidence of a sampler that + // does not sample, and asserting it was a rise the probe must also see + // failed once in ~300 CI runs on an otherwise green tree. + lines.push(if values.len() >= 2 { + format!("{}: moved {lo} -> {hi}, the probe read {} distinct values within it", key.0, values.len()) + } else { + format!( + "{}: moved {lo} -> {hi} across the oracle's reads, but the probe read only {values:?}, \ + so the rise fell outside its window and freshness is NOT asserted on it", + key.0 + ) + }); } else { lines.push(format!("{}: held at {lo} across the bracket, so freshness is NOT asserted on it", key.0)); } -- 2.54.0 (Apple Git-157)