CB-WP-0015: the two inert clauses, AM-7 scaling and AM-8 N=10

Provenance (tier S, one paragraph in lieu of survey and ADR): the two
clauses mutation-check has reported inert since CB-WP-0005. AM-7's
scaling ratio was held up by a test literally named
replay_100k_events_is_linear_and_fast that computed both throughputs,
printed both, and never divided one by the other. AM-8's N=10 was held
up by a runner that does two.

Both are now red. AM-7 3/3, AM-8 2/2, M-D1-MUT 10/14, and ADR-0005's
>=10-of-14 prediction MET for the first time. Neither was closed by
amending the question away, which was the live risk: the denominator is
unchanged and the four unenforced rows are the four already
unenforceable.

AM-7 needed three estimators. Best-of-N per leg then divide (AM-6's,
correct for a floor on one number) gave 0.581-1.085 on an unchanged
binary; legs back-to-back gave medians 0.931-1.004; legs interleaved at
fold granularity give 0.987/0.991/0.989, and 0.989 under 8-way CPU
contention while absolute throughput fell 4x. The INDETERMINATE guard
demanded unanimity and failed a good measurement over one sample
0.001 under the floor; it now requires a two-thirds majority. The
control that matters: AM-6's constant-cost mutation halves throughput
and leaves this ratio at 0.999x green, so AM-7 is not a second AM-6.

AM-8 kept N=10 because the measurement said so. Perturbing the RNG only
from its fourth construction on: --runs 2 PASSES, --runs 10 fails. A
late-onset divergence is deterministic, not flaky, so it is a control
rather than a coin flip. Ten runs live on one scenario (make am8, ~2s)
rather than all 25 (47s a build). GameKernel 5b records it.

The full run also found AM-4a's own mutation stale since ADR-0008 D3
moved the target 250,000 -> 161,000 in CB-WP-0013 -- reported
HARNESS-BROKEN, no score published. The build-free half of that check
is now a --self-test assertion, so make all catches the next one.

mutation-check clauses may now carry their own verify and mutation, and
then the enforced flag is measured rather than declared; a declaration
disagreeing with its measurement is refused.

make all exits 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

specs/GameKernel.md

@@ -209,8 +209,8 @@ evidence lands in `evidence/CB-EV-0001-game-kernel.md` with no
 | ~~AM-4c~~ | M-D2-DEP: own source per third-party 100k lines | — | **WITHDRAWN from the acceptance table 2026-08-01 (CB-WP-0006 T04)** — retained as a reported diagnostic in `make dep-weight`; see §5a | diagnostic |
 | AM-5 | M-D2-BLD: clean release build of headless workspace | n/a (npm install ~seconds; not comparable) | ≤ 60 s on bnt-lap001, recorded not gated | measured |
 | AM-6 | M-D3-THR: applied events/s, synthetic workload, same machine | boardgame.io ~1,100–1,900 moves/s (best config, degrading) | **≥ 100,000/s** (stipulated target, ADR-0002) | measured |
-| AM-7 | M-D3 scaling: throughput @100k events vs @5k; and snapshot+replay of 100k events | boardgame.io 0.45–0.66× @20–40k, DNF @100k | **≥ 0.9×** (flat), replay of 100k events ≤ 5 s, hash-identical | measured |
-| AM-8 | Determinism invariant: N=10 same-seed replays, bit-identical hashes; HashMap-in-state deny lint clean | Rune: enforced by tooling (cited) | zero divergence, lint clean in CI | measured (invariant, not a verdict row) |
+| AM-7 | M-D3 scaling: throughput @100k events vs @5k; and snapshot+replay of 100k events | boardgame.io 0.45–0.66× @20–40k, DNF @100k | **≥ 0.9×** (flat), replay of 100k events ≤ 5 s, hash-identical | measured (`make am7`, `make test`) |
+| AM-8 | Determinism invariant: N=10 same-seed replays, bit-identical hashes; HashMap-in-state deny lint clean | Rune: enforced by tooling (cited) | zero divergence, lint clean in CI | measured (`make am8`, `make check`) — see §5b |
 | AM-9 | M-D3-MEM: peak RSS, 100k-event synthetic run | boardgame.io ~100→232 MB @5k→40k (indicative) | ≤ 64 MB, flat with history given snapshot interval | measured (indicative label, same method) |
 | AM-10 | M-D4-LEAK **(withdrawn 2026-07-31, ADR-0005 §4 — no `cb-*-api` crate exists, so the population is empty; the clippy `HashMap`/`HashSet` deny that stood in for it cites K6 determinism and is now reported as AM-10′)**: foreign types in canonical-interface signatures | boardgame.io: JS-ecosystem-locked | **0** | measured (grep/deny rule) |
 | AM-11 | M-D4-SWAP **(met 2026-08-01 — `KernelRng` and `LogStore` each drive one shared `conformance()`; CB-WP-0006 T05)**: null + reference impls passing one conformance suite | no candidate has the pattern | RNG and log storage each have ≥2 impls (real + test/null) under one suite | measured (bool) |
@@ -257,6 +257,39 @@ Comparisons against the event-sourcing 10⁵–10⁶/s estimate stay **parity**
 until a local Rust comparator is measured (open follow-up from the
 adversarial review).
 
+### 5b. Where AM-8's ten runs live, and why not everywhere
+
+*(CB-WP-0015 T02, 2026-08-02. Tier S. The spec value N=10 is **not**
+amended — this records where it is enforced.)*
+
+For eight passes the runner executed each scenario **twice** (K8) while
+this row said ten, and `mutation-check` reported the count inert every
+run. Closing it needed an argument about what the extra runs buy, because
+"the spec says ten" is not one.
+
+**A deterministic divergence does not need ten runs.** A seed threaded
+wrong or a fold that depends on insertion order diverges on run 2 exactly
+as reliably as on run 10. For that class K8's double-run is sufficient and
+the other eight are repetitions of an answered question — 47 s per build
+across 25 scenarios.
+
+**A late-onset or probabilistic divergence does.** Measured, on
+`gr-r06-round-resolve` with the RNG perturbed only from its fourth
+construction onward: `--runs 2` **passes**; `--runs 10` fails with *"run 1
+hash … != run 4 hash … (of 10)"*. That is a real class the double-run
+structurally cannot see, and it is deterministic rather than flaky, so it
+can be a control rather than a coin flip.
+
+So both stay, at their own costs: **K8's two runs on every scenario**
+(broad, cheap, `make sim`) and **ten runs on one scenario** (deep, ~2 s,
+`make am8`). The clause is now measured by that mutation rather than
+declared by its author.
+
+The primary defence against the probabilistic class remains the
+`HashMap`/`HashSet` deny lint under K6 — this row's other clause, already
+live. The ten runs are defence in depth against that exclusion failing,
+which is why one workload's worth is proportionate.
+
 ## 5. Out of scope for this pass
 
 Networking/session protocol, WIT/Wasm game boundary, ECS world layer,