clay-borg/evidence/CB-EV-0010-render-port.md

# CB-EV-0010 — tier L at full weight, and what it deleted

CB-WP-0012 T05. Measured 2026-08-02 at `84d6886`. Pass kind `product`.

The previous pass was the CHAOS gate's first fire, rolling this same
declaration from L down to S. This one rolled a 1 and ran at L. So for the
first time there are two passes on the same subject at two tiers, and the
comparison is the point.

---

## 1. What full-weight review actually did

**It deleted the thing the pass was declared to build.**

The declaration's structural trigger was *"creates a new capability port."*
The survey recommended `cb-render-api` + `cb-render-null` +
`cb-render-html`. The adversarial review (C3) found that recommendation
contradicted the survey's own citation of INTENT's second-use rule, and
the response conceded entirely. **What shipped has no port and no null
implementation** — a renderer against the existing `Project` trait, and a
deferral with a named trigger.

That is the strongest evidence yet that step 2 is not ceremony. A tier-S
pass has no step 2, would have shipped `cb-render-api`, and stage 2 would
have found it unimplementable and rewritten it — which is exactly what
`CommitWindow` is already on record in this repo for doing.

**Four of six challenges were conceded, not answered.** Two of them
invalidated the survey's main arguments:

| challenge | outcome |
|---|---|
| C1 the sub-100k region was never measured | conceded; **it is not empty** |
| C2 "cost zero" scored on an axis chosen to produce zero | conceded; one rule now covers browser, `sdl2` and `fltk` alike |
| C3 the port contradicts the second-use rule | conceded; **port withdrawn** |
| C6 the C1 measurements had no positive control | conceded; re-measured under it |
| C4 loopback server undersold | controls adopted into ADR-0007 |
| C5 the gate stops at the language boundary | controls adopted into ADR-0007 |

**Fidelity note, which caps all of the above.** The review ran in the same
session as the survey, not a separate one, because this environment's
standing instruction is not to spawn agents unasked. It therefore inherits
the author's sampling — the exact failure mode that produced CB-WP-0002's
dedup blind spot and CB-WP-0005's AM-7 defect. Treat the six challenges as
a lower bound.

## 2. The numbers the survey got wrong, and by how much

The survey's first draft argued the render port was unaffordable:

> *"The cheapest candidate that opens a window costs 128 times the entire
> remaining budget. This is not a near miss to be negotiated; it is two
> orders of magnitude."*

Both halves were wrong, in the same direction, for two independent
reasons — and they compound:

| | claimed | measured |
|---|---:|---:|
| AM-4a headroom | 3,750 | **92,798** (36.2% of the figure is proc-macro code that never ships) |
| cheapest windowed toolkit | 480,501 (`macroquad`) | **140,079** (`fltk`) |
| ratio | 128× | **1.5×** |

The instrument was wrong by 25×, the candidate sample by 3.4×, and the
headline claim by 85×. The 3,750 figure has been cited in every pass that
mentioned AM-4a, CB-WP-0011's reason for deferring this declaration
included.

**The recommendation survived both corrections**, and only because it was
re-derived rather than defended: the argument moved from *affordability*
to *allocation* — stage 2's `wgpu` bill is **1,741,979** marginal lines,
twelve times the stage-1 toolkit it would replace, so buying `fltk` means
spending 1.5× the remaining budget on something stage 2 discards. That
argument needs no particular value for AM-4a's target, which is why it is
worth more than the one it replaced.

## 3. AM-4a cannot survive stage 2 — raised, not decided

| | marginal lines |
|---|---:|
| AM-4a target, **total** | 250,000 |
| `wgpu` + `winit`, named by INTENT stage 2 | **1,741,979** |

**7× the entire target, 19× the corrected headroom.** No sequencing,
feature-gating or metric correction closes that. AM-4a as targeted is
incompatible with INTENT as written, and has been since both were written;
nothing in this pass caused it.

Reserved for the maintainer along with the acquisition rule of ADR-0007
Decision 3 — which is proposed by the pass that benefits from it, is
written to cost more than it saves, and is still an argument rather than a
ratification.

## 4. What shipped, and what has never been run

`cb-render-html`: HTML/SVG/JS emission, pointer-fact resolution, and a
loopback listener. `cb-play --serve PORT`. **Measured** marginal cost:

```
games-ground shipped:  23 third-party crates
cb-render-html:        23 third-party crates
new crates introduced:  0
```

AM-4a unmoved at 246,250. Own source 7,636 → 9,652.

Eight mutations run, each red for its stated reason. Two results worth
more than the six that behaved:

- **The coverage gate fired on its author again**, first run, before
  commit: `ground_choices.*.choice`, `ground_choices.*.problem` and
  `players.*.blame_from` were in neither list. The third is the one to
  keep — an **empty vector is a leaf path of its own**, and a fixture
  where every collection is populated would never have produced it. It
  now renders as an explicit absence (`blamed by none`).
- **One mutation did not go red.** Removing the `Sec-Fetch-Site` arm alone
  left the cross-site test green: the `Origin` check caught it
  independently. Both had to go before the control bit. Defence in depth
  is fine; a control that passes for a reason you did not intend has not
  been demonstrated, and would have been reported as a clean result by
  anyone who ran one mutation and stopped.

### What has never been executed

**The emitted JavaScript has never run.** Every test is on the Rust side:
the socket loop is driven by synthetic HTTP, and the page is asserted
against as a parsed document. No browser engine has executed `SCRIPT`.

So "hot-seat play" is delivered in the sense that the Rust half is tested
end-to-end over a real socket and the page is emitted correctly — and
**not** in the sense that anyone has played a game in a browser. Control 5
bounds the exposure (the JS is 20 lines and holds no game logic, by
assertion) but does not remove it.

**INTENT stage 1 is therefore left open.** Its four named deliverables now
all exist, which is the first time that has been true — but a stage marked
complete on the strength of code that has never been run once is the
failure mode stage 0 avoided by leaving the CLI player open for three
passes. Closing it is the maintainer's call, and it needs one person to
open the URL.

## 5. Cost, shape, and a prediction that held

| pass | kind | responses | cost | $/response |
|---|---|---|---|---|
| CB-WP-0008 | product | 134 | $17.38 | 0.123 |
| CB-WP-0009 | meta | 46 | $11.31 | 0.246 |
| CB-WP-0010 | product | 26 | $4.08 | 0.157 |
| CB-WP-0011 | product | 71 | $7.02 | **0.099** |
| **CB-WP-0012** | **product** | **72** | **$8.82** | **0.123** |

**Correcting CB-EV-0009 §4.** It reported CB-WP-0011 as `45 responses,
$4.23, 0.094 $/response` and called it the cheapest pass on record. The
final figures are **71 responses, $7.02, 0.099**. Still the cheapest, so
the conclusion holds — but the number does not, and this is the *second*
consecutive pass to report its own cost low mid-flight (CB-EV-0008 did the
same for CB-WP-0009). Twice is a pattern: **a pass cannot measure its own
cost, and every evidence file that quotes its own is quoting a floor.**
Future evidence files should quote the prior pass's final figure and mark
their own as provisional.

This tier-L pass cost 0.123 $/response against the rolled-down pass's
0.099 — **24% more per response**, for a pass that also deleted its own
deliverable and found two errors of a factor of 25 and 85. That is the
first priced comparison of the two tiers on the same subject, and on this
one data point step 2 is cheap.

**Meta budget: 0%**, exactly as CB-EV-0009 §4 predicted:

> *"if the next pass is `product`, the trailing-3 meta share drops to 0%,
> because CB-WP-0009 will be the pass that rolled off. If it does not, the
> windowing is wrong in a way neither CB-EV-0007 §3 nor CB-EV-0008 §1
> found."*

Falsifiable, published in advance, and it held. The windowing is doing
what ADR-0006 D1 says it does.

### Session shape

| metric | this pass | target |
|---|---|---|
| SH-1 mean context | 209,486 `[SOFT]` | ≤ 200,000 soft / 300,000 hard |
| SH-2 p90 context | 210,760 `[ok]` | ≤ 300,000 / 450,000 |
| SH-3 batching | 0.0% `[SOFT]` | ≥ 20% |

SH-1 drifted back over the soft line — a tier-L pass reads more than a
tier-S one, which is the mechanism, not an excuse. The standing prediction
from CB-EV-0009 (*"the next pass opened above the SH-1 hard line will cost
more per response than 0.123"*) is **untested**: this pass opened after a
compaction, below the line.

**SH-3 has now read 0.0% for six consecutive passes** against a 20% floor.
It is the oldest unargued number in the project: either the floor is wrong
or the behaviour is, and no pass has argued either. It is past time this
was a declaration of its own rather than a line in an evidence file.

## 6. Open

- **INTENT stage 1 stays open** — all four deliverables exist; none of the
  browser half has been run. §4.
- **Two items reserved for the maintainer**: AM-4a vs stage 2, and
  ADR-0007 Decision 3's acquisition rule. §3.
- **CHAOS gets its second entry**, and it is the more interesting one: the
  first came from an override, this one from a *non*-override that deleted
  its own structural trigger. Window open to 2026-09-30; 7 of 12
  declarations used, 1 override.
- **GATE-REVIEW still has zero `caught`**, two passes older.
- **SH-3 at 0.0% for six passes.** §5.
- **`cb-play` is now three modes in one binary** — play, inspect, serve.
  CB-EV-0009 §5 named the third mode as the second use at which the
  single-binary shape should be reconsidered. That is now due, and this
  pass did not do it.
- **The proc-macro correction to AM-4a is filed and unimplemented.**
  ADR-0007 Decision 4. Until it lands, every AM-4a figure in this repo
  overstates the load by 36%.