ACL-TTL overhead: full 18-cell campaign complete, FABRIC-2.md Section S

-- +0.0604% mean, architecture-independent, fully deterministic

All 18 cells (9 arch/seed pairs x disabled/enabled, zuse-authenticated
throughout) complete: 8,640/8,640 rows, 0 errors. Every disabled cell
reads exactly 261063 ticks -- CV=0.000% across all 3 architectures and
3 seeds. Every enabled cell's tick count depends only on seed, identical
across all 3 architectures for a given seed. Pooled overhead: +0.0604%
(mean +0.0604%, stdev 0.0010%, range +0.0598%-+0.0617%).

This is now the accepted ACL-TTL overhead figure for this workload,
superseding Section P's invalidated wall-clock numbers (ACL never
actually armed) and refining Section R's single-pair pilot (+0.0448%,
n=1) to a tight, fully-reproducible, architecture-independent result
across 9 independent pairs.

One tooling bug fixed mid-campaign (cells 1-3): tick-extraction regex
missed the "[Hera] " console-tagger line prefix; underlying VM runs
were unaffected, affected cells' values recovered by hand from their
serial logs before the fix.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

FABRIC-2.md

@@ -2387,3 +2387,70 @@ architecture, one seed. Determinism confirmed for the disabled arm only. Before
 +0.0448% as a project-wide ACL-TTL overhead figure, the same 9-(arch,seed)-cell × 2-state design
 as Section P should be re-run with the zuse-authentication fix included throughout — this was
 not undertaken in this pass; scoped as the natural next step.
+
+---
+
+## S. ACL-TTL overhead — full 18-cell campaign, zuse-authenticated, 2026-08-21
+
+The natural next step scoped at the end of Section R: the same 9-(arch,seed)-cell × 2-state
+design as Section P, re-run with the zuse-authentication fix throughout. Completed in full.
+Randomized 18-cell order (Fisher-Yates via Python `random.seed(20260821)`, no ISA or ACL-state
+blocking — same discipline as Sections M/O/P), independent `clean` build per cell, driven by an
+automated script (`run_cell.sh`, scratchpad) replicating Section R's exact validated procedure:
+boot → `S" doe.4th" EXEC` → (`enabled` only: `S" ACL.4th" EXEC` then `ZUSE-AUTHENTICATE`
+directly, bypassing the known-broken `ACL-ZUSE-BOOT` self-activation) → `HB-OFF` →
+`HEARTBEAT-TICKS@` → `<seed> 30 EXEC-DOE` → wait for `DOE: complete` → `HEARTBEAT-TICKS@` →
+`HB-ON` → teardown. All 18 cells: 480/480 rows, 0 errors — **8,640/8,640 rows total**. Data:
+`experiments/bare_metal/runs/acl-ttl-overhead-20260821-ticks/ticks.csv`.
+
+One tooling bug found and fixed mid-campaign (cells 1-3 only): the driver's tick-value
+extraction regex assumed lines started with the digit (`^[0-9]+`), missing the `[Hera] `
+console-tagger prefix every line actually carries, so it returned empty for cells 2 and 3. The
+underlying VM runs were unaffected (480/480 rows, clean completion) — only the automated
+extraction failed; the two affected cells' tick values were recovered by hand directly from
+their serial logs before the regex fix (`sed -n 's/^\[Hera\] \([0-9][0-9]*\).*/\1/p'`) was
+applied to the script for cells 4-18.
+
+**Result:**
+
+| arch    | seed  | disabled | enabled | overhead (ticks) | overhead (%) |
+|---------|-------|----------|---------|-------------------|--------------|
+| amd64   | 12345 | 261063 | 261224 | 161 | +0.0617% |
+| amd64   | 13579 | 261063 | 261219 | 156 | +0.0598% |
+| amd64   | 67890 | 261063 | 261219 | 156 | +0.0598% |
+| aarch64 | 12345 | 261063 | 261224 | 161 | +0.0617% |
+| aarch64 | 13579 | 261063 | 261219 | 156 | +0.0598% |
+| aarch64 | 67890 | 261063 | 261219 | 156 | +0.0598% |
+| riscv64 | 12345 | 261063 | 261224 | 161 | +0.0617% |
+| riscv64 | 13579 | 261063 | 261219 | 156 | +0.0598% |
+| riscv64 | 67890 | 261063 | 261219 | 156 | +0.0598% |
+
+**Every disabled cell reads exactly 261063 ticks — all 9, all three architectures, all three
+seeds. CV = 0.000%, to the tick.** Every enabled cell's tick count is determined solely by
+seed, identical across all three architectures for a given seed (261224 for seed 12345, 261219
+for seeds 13579 and 67890). This is a stronger determinism result than Section R's single
+double-confirmed pair — the whole 18-cell grid is exactly reproducible and completely
+architecture-independent, consistent with this project's documented deterministic-physics
+design goal.
+
+**Pooled overhead: +0.0604%** (2,349,567 disabled ticks vs. 2,350,986 enabled ticks, summed
+across all 9 pairs). **Mean per-cell overhead: +0.0604%, stdev 0.0010%** (range +0.0598% to
++0.0617%, driven entirely by which of the two seed-dependent enabled values a cell falls into
+— seed 12345 costs marginally more than 13579/67890, plausibly because its particular
+`SHUFFLE-MATRIX` ordering happens to route slightly more dispatches through TTL-expiry cold
+paths). No architecture-dependent variation at all — amd64/aarch64/riscv64 are identical to
+the tick within each seed.
+
+**Reconciliation.** Matches Section R's single-pair pilot (+0.0448%) in order of magnitude and
+now, with 9 independent pairs instead of 1, resolves it to a tighter, fully-arch-independent
+figure. Also consistent with the original ACL-RWT campaign (`.claude/CLAUDE.md`:
++0.0054%–+0.0088%, CV = 0.000%) — same order of magnitude, same deterministic-instrument
+character, different absolute figure because that campaign measured a different workload/ACL
+configuration than this one's `EXEC-DOE` 16×30 run. Section P's wall-clock +5.30%/+4.42% figures
+remain invalidated (Section P's note) — they measured dictionary-load-plus-jitter cost with ACL
+enforcement never actually armed, not this.
+
+**Status: this is now the accepted ACL-TTL overhead figure for this workload — +0.0604% mean,
+architecture-independent, fully deterministic.** Superseding Sections P and Q's numbers, which
+remain in place as historical record of the investigation (per repo convention), not as
+competing estimates.

capsules/BLOCK_MAP.md

@@ -1,5 +1,5 @@
 # Capsule Block Manifest — Auto-generated
-<!-- Generated by mkcapsule --manifest  2026-08-21T18:56:36Z -->
+<!-- Generated by mkcapsule --manifest  2026-08-21T19:00:44Z -->
 <!-- DO NOT EDIT — re-run mkcapsule --manifest to refresh.  -->
 <!-- Hand-written justifications and immutability notes live  -->
 <!-- in MANIFEST.md alongside this auto-generated index.      -->

experiments/bare_metal/runs/acl-ttl-overhead-20260821-ticks/ticks.csv

@@ -16,3 +16,4 @@ order,arch,seed,acl,before_tick,after_tick,delta_ticks,rows,errors
 15,riscv64,67890,disabled,79,261142,261063,480,0
 16,aarch64,13579,disabled,79,261142,261063,480,0
 17,riscv64,13579,disabled,79,261142,261063,480,0
+18,amd64,13579,disabled,79,261142,261063,480,0