eoc-meter: a GPU rise the oracle saw is not one the probe must have seen #250
2026-10-14
eoc-meter: a GPU rise the oracle saw is not one the probe must have seen
All checks were successful
energy meters on real hardware / RAPL and NVML on jetson-hub (pull_request) Successful in 40s
standards workspaces build + test / jouleclaw-rs (pull_request) Successful in 2m24s
standards workspaces build + test / aac-rs (pull_request) Successful in 2m52s
standards workspaces build + test / joule-code-rs (pull_request) Successful in 1m26s
standards workspaces build + test / joulecontract-rs (pull_request) Successful in 59s
standards workspaces build + test / map-rs (pull_request) Successful in 1m0s
standards workspaces build + test / mesh-rs (pull_request) Successful in 56s
standards workspaces build + test / openpay (pull_request) Successful in 2m38s
standards workspaces build + test / jouledesk-rs (pull_request) Successful in 54s
standards workspaces build + test / macOS energy backends (pull_request) Successful in 4m41s
lockfiles / every Cargo.lock is current (pull_request) Successful in 42s
spec citations resolve / Code cites no section its SPEC lacks (pull_request) Successful in 3s
standards workspaces build + test / arl-rs (pull_request) Successful in 1m10s
standards workspaces build + test / jcp-rs (pull_request) Successful in 1m51s
standards workspaces build + test / eoc-rs (pull_request) Successful in 2m13s
standards workspaces build + test / joule-ui-rs (pull_request) Successful in 1m13s
standards workspaces build + test / joulehook-rs (pull_request) Successful in 1m14s
standards workspaces build + test / proof-rs (pull_request) Successful in 1m28s
standards workspaces build + test / sandbox-rs (pull_request) Successful in 2m23s
standards workspaces build + test / sense-rs (pull_request) Successful in 1m9s
tests in CI / every test file is run by a job or listed with its reason (pull_request) Successful in 4s
standards workspaces build + test / smart-byte-rs (pull_request) Successful in 4m0s
`the_production_probe_hands_the_rule_what_the_oracle_reads` failed once on an
otherwise green tree -- the only failure of that job across 309 commits:
("GPU Energy", 0) moved 1508467856154491 -> 1508467860032551 across the
oracle's reads, but every one of the 20 samples the production probe took
read [1508467856154491]
The assertion behind it does not hold. The oracle's two reads *bracket* the
probe's samples, so a rise it saw can fall entirely outside the probe's own
window. GPU energy is activity-driven, not a clock: it rises only while the GPU
works, so on a shared host another process's short burst lands between the
oracle's first read and the probe's first sample as readily as inside it. The
observed delta is about one tick's worth. One value is therefore no evidence of
a sampler that is not sampling.
The same block already reasons this way one branch over -- a rail that held
across the bracket is reported with "freshness is NOT asserted on it" -- and
sandbox-meter's equivalent prints its GPU-hold case rather than asserting it.
This applies that reasoning to the case where the rail moved: the count of
distinct values is reported either way, and nothing is asserted from it.
Every other assertion is untouched, including the one that each handed sample
lies within the oracle's bracket.
What this gives up: a sampler that cached one reading and handed it back would
no longer be caught here. The liveness tests are what cover a rail that does
not advance (`the_liveness_probe_never_reports_a_frozen_rail_as_live`,
`the_ioreport_meter_is_never_available_on_a_frozen_cpu_rail`). Restoring a
sound version of this check means driving GPU work inside the probe's own
window, so a rise is guaranteed to be there to see; that is a larger change
than this one.
Verified on the IOReport host: 17 of 17 `macos_ioreport` tests and all 80
eoc-meter lib tests pass. That run took the held branch, so it exercises the
paths around this change rather than the rare case itself, which by
construction cannot be forced.
Co-Authored-By: Claude Opus 5 <[email protected]>