diff --git a/FABRIC-2.md b/FABRIC-2.md
index 1c39e12..ea224db 100644
--- a/FABRIC-2.md
+++ b/FABRIC-2.md
@@ -58,10 +58,30 @@ and recorded.
   is the single most concrete open item carried into this document — real, live, and
   unmeasured.
 
-- [ ] **Multi-VM heartbeat ownership.** Whose `tick_target_ns` drives the one physical timer
+- [x] **Multi-VM heartbeat ownership.** Whose `tick_target_ns` drives the one physical timer
   (FABRIC.md §26.5) has only one answer while Hera is the only VM; explicitly "not resolved
   for when Hermes/Artemis return." Hermes has returned (item 4.2). Same situation as the
   fleet heat leak above — a deferral whose triggering condition has since become true.
+  **Ruled:** there is exactly one physical timer, so exactly one VM may write its re-arm
+  period — never whichever VM's `vm_tick()` happened to run last. Hera is the fixed point
+  everywhere else in this design (patron zero, sole capacity arbiter, sole birther/killer of
+  VMs — see FABRIC.md §20.2, §26), so she is the sole owner here too. Every other VM's Loop
+  #7 (`vm_tick_inference_engine()`) still adapts its own `vm->heartbeat.tick_target_ns`
+  exactly as before — that per-VM bookkeeping is correct and untouched — it simply never
+  reaches the shared physical re-arm; only Hera's does.
+  *Done when:* `vm_tick_inference_engine()` gates the physical-timer re-arm behind
+  `vm_uuid_is_hera(vm->stadium_vm_id)`, and a three-arch QEMU boot with Hermes live (item
+  4.2) is clean.
+  *Refs (FABRIC.md):* §20.2, §26.5.
+
+  > **DONE 2026-08-13.** `vm_tick_inference_engine()`
+  > (`src/starkernel/vm/vm_runtime.c:766`) now wraps the kernel-base re-arm block in
+  > `if (vm_uuid_is_hera(vm->stadium_vm_id))`, using the existing
+  > `vm_uuid_is_hera()` (`src/starkernel/capsule/vm_uuid.c:51`) already used the same way at
+  > the birth/kill call sites in `capsule_birth.c` and `capsule_vm_physics.c`. Three-arch
+  > acceptance boot, all clean to `ok>`, Hermes live and self-testing in every log:
+  > `logs/20260813-075940/amd64`, `logs/20260813-080125/aarch64`,
+  > `logs/20260813-080257/riscv64`. Committed `bcc72d0`.
 
 ---