doc: retarget citations of the removed time ABI specification

doc/build.md

@@ -284,9 +284,9 @@ the production RCU stall timeouts and turns off the debug options that
 detectors are missing from the generated config. CI can shorten the soft-lockup
 and hung-task thresholds for one boot with `watchdog_thresh=` and
 `sysctl.kernel.hung_task_timeout_secs=`. The RCU stall timeout stays at the
-production value because the time ABI's conformance check C8, which covers
-the [stall-detector settings](design/3.2-clock-and-time.md#3210-guest-obligations),
-requires it.
+production value because the time ABI's conformance checks cover the
+[stall-detector settings](design/3.2-clock-and-time.md#3210-guest-obligations)
+and require it.
 
 The variant builds in `build/linux-debug`, so it never invalidates the
 production object cache, and it produces:

doc/ci.md

@@ -112,12 +112,12 @@ The `time-abi-conformance` scenario boots the largest requested vCPU count and
 runs the guest's exhaustive CI check, `/sbin/nvx-time exhaustive`, which the
 boot check leaves to CI. On every online CPU it checks every leaf
 `0x40000006..=0x400000ff` and every base `0x40000100..=0x4000ff00` for another
-hypervisor signature, every `C3` MSR, the write rules of
-`HV_X64_MSR_TSC_INVARIANT_CONTROL`, writes to the read-only identity MSRs, and
-reads of `IA32_TSC_ADJUST` and `IA32_TSC_DEADLINE` (checks `X1` to `X6`). The
-harness requires a passing `NVX-TIME-ABI-EXHAUSTIVE` line for every check on
-every CPU, a summary with `status=ok`, the requested CPU count, and no
-failures, and exit status 0; a failure lists each failing check with the
+hypervisor signature, every identity MSR that the boot check reads, the write
+rules of `HV_X64_MSR_TSC_INVARIANT_CONTROL`, writes to the read-only identity
+MSRs, and reads of `IA32_TSC_ADJUST` and `IA32_TSC_DEADLINE` (checks `X1` to
+`X6`). The harness requires a passing `NVX-TIME-ABI-EXHAUSTIVE` line for every
+check on every CPU, a summary with `status=ok`, the requested CPU count, and
+no failures, and exit status 0; a failure lists each failing check with the
 guest's detail. The guest command fits on one console line, so the console's
 echo of it ends before the check prints.
 The `cpu-profile-fallback` scenario covers `--cpu-profile auto`'s fallback to a
@@ -175,7 +175,7 @@ deferred checks and must report a passing restore line, so no restore leaves
 its checks pending. The one exception is `snapshot-tiers`' gate-timeout check,
 whose guest OpenVMM stops at the restore gate on purpose. The harness refuses
 a kernel whose `vmlinux-debug.config` lacks the detectors, because the guest's
-`C11` check passes vacuously without them. To bound the cost, pull requests
+boot check of those detectors passes vacuously. To bound the cost, pull requests
 run the debug kernel on KVM only and `dev` pushes run it on every backend;
 each job takes about five minutes on its own runner, in parallel with the
 other microVM jobs. The jobs gate the required status check, the development

doc/design/3.2-clock-and-time.md

@@ -356,7 +356,10 @@ the bound for its use.
 The guest agents perform conformance checks, watch for violations, discipline
 the wall clock, and execute the snapshot time steps in every guest mode.
 Production paths keep the console quiet; status goes to a state file that the
-workload can read through a read-only mount.
+workload can read through a read-only mount. The state file reports the
+outcome of each phase's checks, the declared rates, the generation, the last
+downtime and its source, and the wall clock's discontinuities,
+synchronization, offset, uncertainty, and frequency correction.
 
 **Conformance.** Before readiness, the guest only takes a time sample within
 the bound and steps its clock to host UTC, so the workload starts on host
@@ -366,9 +369,11 @@ the workload. The checks cover the identity leaves and explicit zero leaves,
 the CPU time bits on every CPU, the identity MSRs, the kernel's platform,
 clocksource, and LAPIC-timer selection, CPU flags, tick devices, the absence
 of forbidden clock parameters, stall-detector settings, a running violation
-watcher, and kernel W+X integrity. Capture and restore rerun the relevant
-subset. Every check is fail-fast: a failure powers the guest off even if the
-workload is running.
+watcher, and kernel W+X integrity. Capture reruns the clocksource,
+tick-device, and watcher checks. Restore reruns them too, checks the declared
+rate in the frequency MSR again, and checks the identity leaves, the CPU time
+bits, and the CPU flags of every processor that it brings online. Every check
+is fail-fast: a failure powers the guest off even if the workload is running.
 
 **Violation watcher.** The watcher follows the kernel log from before the boot
 checks, so no record is missed. TSC instability; clocksource instability,
@@ -398,7 +403,10 @@ applications. The kernel limits the frequency correction to ±500 ppm, of which
 the rate tolerance uses at most 250 ppm. A sample whose generation differs
 from the recorded one is discarded, because a restore happened and restore
 repair resets the discipline. The discipline follows host wall-clock steps
-and never powers off the guest.
+and never powers off the guest. Restore repair and the discipline step the
+clock through the kernel, so a workload can observe every step through the
+kernel's clock-set notification, such as a `timerfd` armed with
+`TFD_TIMER_CANCEL_ON_SET`.
 
 The [snapshot protocol](5.3-snapshot-protocol.md) and
 [guest repair](5.5-restore-protocol.md#557-guest-repair) define the snapshot

doc/openvmm-upstream-roadmap.md

@@ -5,7 +5,7 @@
 - OpenVMM fork base: `e1cdbd916d3aacb216309c8e7779b832546759a1`.
 - Mapped fork tip: `2728f33ea9a44d2d0fb956d9f01768ae2100fb62`, position 166. The graph, PR
   summary, and commit mapping below cover positions 001-166.
-- NVX's pinned OpenVMM revision: `7f225e2cd635bbd1e1839e587e659996433396c8`, 151 commits past the
+- NVX's pinned OpenVMM revision: `c6d97c529986c0b3b1bf1fd7f00406654cdeee67`, 152 commits past the
   mapped tip on the same first-parent chain. These commits are not yet assigned to PRs; see
   [Commits after the mapped tip](#commits-after-the-mapped-tip).
 - Upstream main: `1fd455b19e7c69c72a2d375d0ed1cb35d901c688` (2026-10-01), 18 commits past
@@ -199,7 +199,7 @@ e1cdbd916
   -> PR18/PR23 split [162]
   -> PR18 fixup [163] -> PR25 fixup [164] -> PR27 [165-166]
   -> 2728f33ea (mapped tip)
-  -> unassigned [167-317] -> 7f225e2cd (NVX pin)
+  -> unassigned [167-318] -> c6d97c529 (NVX pin)
 ```
 
 For upstream review, PR01-PR08 and PR14 can be rebased independently onto current upstream main.
@@ -215,7 +215,7 @@ can be submitted independently if preferred.
 
 ## Commits after the mapped tip
 
-The NVX pin extends the chain past position 166 without merges. The 151 later commits are not
+The NVX pin extends the chain past position 166 without merges. The 152 later commits are not
 yet classified or assigned to PRs. This table groups them by topic in chain order; ranges are
 inclusive, as in the [PR summary](#pr-summary).
 
@@ -242,6 +242,7 @@ inclusive, as in the [PR summary](#pr-summary).
 | 315 | `dd8def143` | 1 | Private-network ingress: `--network-ingress allow` publishes the guest's announced listeners to clients on the host's private networks |
 | 316 | `a44fcc2aa` | 1 | Bidirectional host-loopback access: `--host-loopback allow` publishes the guest's announced listeners on host loopback for the host alone |
 | 317 | `7f225e2cd` | 1 | IPv6 host peers appear inside the static IPv6 subnet, so the guest answers them from its address there |
+| 318 | `c6d97c529` | 1 | Standalone time ABI documentation: comments describe the contract without citing NVX's removed specification |
 
 Some of these commits change mapped work rather than add to it. Positions 255-259 remove the
 legacy microVM clock paths and change files that PR10 and PR17 also change. Position 261 makes

guest/common/nvx-snapshot

@@ -391,10 +391,11 @@ post_restore() {
     finish_restore "$packet_flags"
 }
 
-# Restore steps 12 and 13: the acknowledgement when the host gated its input,
-# then the daemon's step 11 restore checks and grace-period release, which
-# run off the restore latency path. A second argument of "quiet" omits the
-# stage and completion lines of a plain untiered restore.
+# Guest repair steps 6 and 7 (doc/design/5.5-restore-protocol.md): the
+# acknowledgement when the host gated its input, then the daemon's restore
+# checks and grace-period release, which run off the restore latency path. A
+# second argument of "quiet" omits the stage and completion lines of a plain
+# untiered restore.
 finish_restore() {
     [ "${2:-}" = quiet ] ||
         console_status "NVX-POST-RESTORE-STAGE: acknowledge"
@@ -440,9 +441,10 @@ elif [ "$scratch_policy" = fresh ]; then
     exit 1
 fi
 
-# Capture steps 1 to 3: the capture checks and the stall-detector
-# suppression. They never wait, though nvx-time first lets pending boot
-# checks finish: they start the daemon that the capture checks require.
+# Guest preparation steps 1 and 2 (doc/design/5.3-snapshot-protocol.md): the
+# capture checks and the stall-detector suppression. They never wait, though
+# nvx-time first lets pending boot checks finish: they start the daemon that
+# the capture checks require.
 /sbin/nvx-time pre-capture || exit 1
 stall_detectors_suppressed=true