> **Superseded in part, 2026-08-03 (CB-WP-0019 T01/T02).** This ADR
> ratified AM-4b at ≤350,000 against a graph measuring 317,021 — but that
> graph was **one package with no dev edges**, blind to 28 crates and
> 408,237 lines. AM-4b now asks *what a contributor acquires*
> (`--workspace --edges normal,dev`, proc-macros counted) and its target is
> **745,000**. The reasoning here still stands; the scope it was applied to
> did not. See `specs/GameKernel.md` §5c.

# ADR-0004: ratify AM-4a and AM-4b

> **Superseded measurement (ADR-0008 D2/D3, 2026-08-02).** The AM-4a
> figures below were taken with an instrument that counted proc-macro
> crates — 89,048 lines, 36.2% — which run in the compiler and never
> reach a binary. Corrected, the same tree measures **157,202** against
> a target moved to **161,000**. The numbers below are left as the
> record of what was measured then, and are no longer live facts.


status: accepted
date: 2026-07-31
decided by: maintainer (Bernd Worsch), 2026-07-31
tier: S (structural S — ratifies an existing target, creates no capability; chaos d4=3)
supersedes: nothing; discharges the open item raised by CB-WP-0003 T07
references: [GameKernel.md](../specs/GameKernel.md) §4,
[InnerLoop.md](../specs/InnerLoop.md) §Step 4 (correction vs retarget),
`history/260731-inner-loop-rule-audit.md`

## Why this ADR exists

CB-WP-0003 T07 added a mechanical test separating a **correction** (the
instrument disproved the target; the implementation did not change) from a
**retarget** (the same commit moved both the target and the code it
measures). AM-4a/AM-4b failed that test: they were set at 250,000 and
350,000 in commit `4be6e02`, by the implementer, after seeing the measured
246,250 — and that commit also changed the feature gating the metric
measures.

The reasoning was recorded at the time and is defensible. The *structure*
was not, and the audit flagged both targets as unratified: `make
dep-weight` has been enforcing thresholds no reviewed decision stood
behind.

## Decision

**AM-4a (≤ 250,000 lines, shipped runtime) and AM-4b (≤ 350,000 lines,
dev toolchain) are ratified as written.** No values change.

## The old target, and why it was abandoned

AM-4 originally read **≤ 20 transitive crates**, set against
boardgame.io's 120 npm packages. Retired for two measured reasons:

1. **Unreachable without undoing this spec's own contracts.** K5 (seeded
   ChaCha) and K7 (SHA-256) cost 12 crates between them. The measured
   ladder showed nothing reached 20 except reimplementing one of those
   primitives — trading an audited cryptographic implementation for a
   scoreboard number.
2. **Crate count does not compare across ecosystems.** Rust splits crates
   far more finely than npm, so the original 33-vs-120 comparison
   flattered us while the ≤20 target punished us, for the same reason.

## The measurement that motivated the change

At the time of the retarget, `make dep-weight`:

| configuration | crates | third-party LOC |
|---|---|---|
| shipped-runtime (`--no-default-features`) | 23 | **246,250** | <!-- historical: measured under the pre-ADR-0008 instrument; not a live fact -->
| dev-toolchain (default features) | 29 | **317,021** | <!-- as-measured 2026-07-31; AM-4b was rescoped by CB-WP-0019, see GameKernel 5c -->
| own source | — | 3,443 |

## Why these targets bind on future work rather than merely passing present work

This is the question T07 requires an ADR to answer, and it is the reason
ratification is defensible rather than a rubber stamp.

- **AM-4a leaves 3,750 lines of headroom — 1.5%.** That is roughly one
  small crate. Any dependency added to the shipped runtime breaches it
  almost immediately, which is the intended behaviour: the shipped runtime
  is meant to be effectively frozen, and the target enforces that a new
  runtime dependency is a decision someone must argue for, not a default.
- **AM-4b leaves 32,979 lines — 10.4%.** Deliberately looser. The dev
  toolchain is where scenario YAML, benchmarking, and future tooling land,
  and it does not ship to a player. It should be able to absorb one
  moderate dependency without a spec change, and not two.
- **Both are ceilings on a quantity that only grows by choice.** Nothing
  drifts a project across these thresholds; only adding a dependency does.
  A target that can only be breached deliberately is a target that binds.

**What would falsify this ratification:** if a future pass finds itself
raising AM-4a to accommodate a dependency it wanted, that is the failure
mode the ceiling exists to catch, and the answer is a new ADR arguing for
the dependency — not a quiet retarget.

## Consequences

- The open item in `history/260731-inner-loop-rule-audit.md` is discharged.
- `make dep-weight` continues to fail the build on breach, now backed by a
  reviewed decision.
- AM-4c (own source per 100k third-party lines) remains **reported, not
  targeted**, and is unaffected.
- Precedent: this is the first ADR written under the correction/retarget
  test. Future retargets follow this shape — old target, the measurement,
  and an argument about *future* binding rather than present passing.