FABRIC-2.md: correct §12 Q5's STADIUM_CAPACITY_TICK framing to stay inside the one-clock rule

The prior wording ("give the capacity tick its own named constant...
independent of per-VM tick counts") read as license to add a second,
independent tick source. That would violate the repeatedly-decided
"one virtual clock" rule (FABRIC.md §16.4 GAP-A1, §17.1). Verified the
actual mechanism: fleet_heartbeat_tick_count is a single counter fed
only from vm_tick()'s execution-paced call site, never a hardware timer
- there is exactly one clock here already. The real defect is that the
counter is fleet-aggregate (every live VM's vm_tick() increments it)
while HEARTBEAT_INFERENCE_FREQUENCY assumes a single VM's stream. Fix
is a bigger threshold on the same counter, not a new clock. Corrected
in both the detailed §12 Q5 entry and the F.3 punch list line.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

FABRIC-2.md

@@ -774,10 +774,27 @@ together. **F.3** is the condensed punch list distilled from both.
   4, the shared fleet-capacity counter can already reach `HEARTBEAT_INFERENCE_FREQUENCY` up to
   ~4× sooner in wall-clock terms than a single VM's own heat-inference gate — backwards from
   §22.4's required 1000:1 separation, confirmed by this document's own §12 Q5 investigation
-  above. `STADIUM_CAPACITY_TICK` already exists as a Kconfig symbol, default matching the
-  cited precedent, but is never read by any code path. **Question for Bob:** wire it in for
-  real (giving Hera her own slower cadence independent of per-VM tick counts), or resolve the
-  ordering some other way?
+  above.
+
+  **Correction 2026-08-15 — the fix must stay inside the one-clock rule (`FABRIC.md` §16.4
+  GAP-A1, §17.1 "two measures, one clock... this does not mean two clocks").** `fleet_
+  heartbeat_tick_count` (`capsule_vm_physics.c:157`) is a single counter, incremented once
+  per call to `vm_physics_heartbeat_tick()`, which itself only ever fires from inside the
+  execution-paced `vm_tick()` (`vm_runtime.c:141`) — never from a hardware timer. So there is
+  only one clock here, exactly as ruled; the earlier framing of this item ("give the capacity
+  tick its own named constant... independent of per-VM tick counts") was worded ambiguously
+  enough to read as "add a second clock," which is not the fix and must not be built as one.
+  The actual defect is narrower: `vm_tick()` calls `vm_physics_heartbeat_tick()` from *every*
+  live VM's own dispatch (deliberate, `vm_runtime.c:126-138`'s own comment explains why — the
+  fleet-capacity signal needs to reflect aggregate activity, not just Hera's), so `fleet_
+  heartbeat_tick_count` advances on the fleet's *combined* stream while `HEARTBEAT_INFERENCE_
+  FREQUENCY` was written assuming a single VM's stream. Same one counter, same one clock —
+  the threshold compared against it just doesn't account for multiple VMs feeding it at once.
+  **Question for Bob:** the fix is to give `STADIUM_CAPACITY_TICK` a larger *threshold value*
+  checked against the existing `fleet_heartbeat_tick_count` (still one clock, one counter —
+  just a bigger divisor, e.g. scaled by the live VM count so it restores something closer to
+  the required 1000:1 separation), not a second tick source. Wire it in that way, or resolve
+  the ordering some other way?
 
 **Closed-by-ruling, not reopened this pass** (each already has a recorded "flag and leave"
 decision from Captain Bob — reversing that without being asked would be exactly the
@@ -795,7 +812,9 @@ unreachable NULL-write, `m5_time_trust`/`m5_variance` dead fields.
 
 **Code / actionable — pending Captain Bob's call or Artemis landing:**
 
-- [ ] §12 Q5 — wire `STADIUM_CAPACITY_TICK` for real, or resolve the ordering some other way?
+- [ ] §12 Q5 — give `STADIUM_CAPACITY_TICK` a real threshold against the existing
+      `fleet_heartbeat_tick_count` (one clock, bigger divisor — not a second tick source), or
+      resolve the ordering some other way?
 - [ ] 4.4s → 1.11 → 4.3 → §17.4 chain — no ruling needed, just unstarted work blocked on ACL
       Phase 8 (identity storage), out of this pass's scope
 - [ ] 5.1 (DoE re-run) + ACL-RWT re-measurement — run now, or wait for Artemis (recommended)?