testing

Acceptance is a contract document, not a checklist, so every criterion has to be a number with a tolerance that a vendor can be held to. Comparing nodes against each other rather than against a datasheet is what finds real defects, and the duration is what finds the thermal ones.

A bug that scales with the number of tiles is invisible in a unit test that fits in one tile. The three candidates that produce exactly this signature, the measurement that separates them, and a test design that would have caught all three before the kernel shipped.

Three decisions decide whether this is correct: the numeric type, how partial hours are handled, and what happens to a record that does not make sense. The implementation with its tests, the floating-point trap that costs real money, and the questions to ask before writing any of it.

Two parameters, one lazy refill and one lock. What capacity and rate each control and why conflating them is the usual bug, the clock choice that avoids a whole class of failure, and the retry-after value that turns a rejection into something a client can act on.