Phase-Locked Actuation Commit

When several actuators must move as one, Kronos uses a two-phase commit locked to a shared clock so the group either acts coherently or not at all.

Coherent multi-actuator action

Some actions require several actuators to change together: a synchronized poloidal-field coil step for shape control, or a coordinated gas-and-pellet fueling event. If they act at slightly different times the transient can be worse than the steady state they aimed for. Kronos commits such groups with a phase-locked, two-phase protocol referenced to the distributed clock.

Prepare, then fire

• Prepare: each actuator receives its clamped setpoint and arms, reporting readiness.
• Barrier: the coordinator waits for all-ready or the prepare deadline.
• Fire: on a shared future clock edge, all armed actuators execute in the same window.
• Abort: if any actuator is not ready by the deadline, none fire and the group reverts.

def phase_locked_commit(actuators, fire_edge_ns, prepare_deadline_ns, now_ns):
    armed = [a for a in actuators if a.arm()]        # phase 1: prepare
    if len(armed) != len(actuators) or now_ns > prepare_deadline_ns:
        for a in armed: a.disarm()                   # atomic abort
        return 'aborted'
    for a in armed:
        a.schedule_fire(fire_edge_ns)                # phase 2: same edge
    return 'committed'

The protocol is all-or-nothing: a partial fire is never allowed, because a half-executed coordinated action is exactly the failure mode it exists to prevent. If the group aborts, each actuator holds its prior safe setpoint, which is always a defined, benign state.

The prepare-then-fire structure also gives the supervisory tier a clean failure signal: if a group repeatedly aborts because one actuator will not arm, that actuator is flagged for maintenance rather than silently degrading the coordinated action. Because the abort is atomic and the fallback is each actuator's prior safe setpoint, a chronically unready actuator reduces capability but never creates a hazardous partial action, which is exactly the property a coordinated fueling or coil step needs.

This is distinct from the general orchestration two-phase commit in L4; here the commit is bounded to a single clock window and carries a hard deadline, so it lives in the reflex tier. It builds directly on the synchronized actuation gates and the clock distribution described in the L1 control plane.