clay-borg/history/260802-render-port-response.md

260802 — response to the challenge on CB-RES-0006

One round, per InnerLoop §Step 2. Four challenges conceded, two answered with evidence, and one of the concessions turned up something larger than this pass.

---

C1 — the unmeasured interval — conceded, and the framing withdrawn

The challenge is right and the survey's rhetoric was wrong. "Two orders of magnitude" described the candidates I picked, and I picked them from what a 2026 Rust developer reaches for, which is a list of GPU-era stacks. The real floor for a windowed toolkit is fltk at 140,079 marginal lines — 1.5× the corrected headroom, not 128×.

The C1 table is folded into the survey as measured data, including tiny-skia at 83,956, which fits inside 92,798 and disproves the interval claim by itself.

So dependency cost alone does not decide this. The survey's argument as written is withdrawn. What replaces it is an allocation argument, and it is stronger:

INTENT stage 2 names wgpu explicitly. That is a 1,741,979-line marginal cost, already measured, already unavoidable, and it arrives one stage from now. Against that, spending 1.5× the entire remaining budget on a stage-1 windowing toolkit that stage 2 immediately discards is the wrong allocation — not because it does not fit, but because it buys a thing with a known expiry using money already committed elsewhere.

That argument does not need AM-4a's target to be exactly 250,000. It only needs stage 2's bill to be larger than stage 1's benefit, which is measured, and true by a factor of twelve.

C1b — what the concession exposed: AM-4a cannot survive stage 2

Following C1 honestly produces a finding neither the survey nor the challenge was looking for.

	marginal lines
AM-4a target, total	250,000
current shipped-runtime (corrected, proc-macro excluded)	157,202
headroom	92,798
wgpu + winit, which INTENT stage 2 names by name	1,741,979

Stage 2 exceeds the entire AM-4a target by 7×, and exceeds the remaining headroom by 19×. No sequencing, no feature-gating and no metric correction closes a gap that size. AM-4a as targeted is incompatible with INTENT as written, and has been since both were written; nothing in this pass caused it.

That is a maintainer's decision, not mine — either the target moves, or the port stays out of the AM-4a configuration by an argued rule, or stage 2 changes. It is recorded here and carried to the evidence file, and it is deliberately not resolved by this pass, because a pass that discovers a budget conflict and also decides it has reviewed nothing.

It does, however, retire one bad reason for the recommendation. "HTML, because we cannot afford anything else" is false. "HTML, because stage 1 should not spend stage 2's money on something stage 2 throws away" is true.

C2 — the metric is gameable by relocation — conceded; one rule, stated

The challenge is right that the survey scored the browser at zero on an axis chosen to produce zero, and right that the same move already makes sdl2 and fltk look cheap in the survey's own table. I had not noticed, because I had measured no bindings.

The rule, which belongs in AM-4's definition and not in this pass's reasoning, applied consistently to all three:

AM-4 counts third-party code the project causes to be acquired. It does not count runtimes the user already has independently of us — the kernel, the system C library, the shell, the terminal, a web browser. It does count a library our build or install instructions cause to be fetched, pinned, or linked, whether or not its source is Rust.

Under that rule, consistently:

• a browser is not counted — nothing we ship or instruct causes it to be acquired;
• sdl2/fltk are counted at more than their Rust binding, not less — they oblige a user to install a -dev package they would not otherwise have, so the survey's 191,973 and 140,079 understate them;
• and the rule makes the metric harder to satisfy by relocation, not easier, which is the direction a rule proposed by the party it benefits has to go before it is worth anything.

This makes the HTML row honest rather than merely favourable. It also means the survey's table understates two candidates, and that correction is folded in.

C3 — the port contradicts the second-use rule — conceded entirely

Recommendations 1 and 4 cannot both stand, and 4 is the one INTENT supports. CommitWindow is already in this repo with a delete-by date for exactly this mistake.

cb-render-api is withdrawn from this pass. cb-render-html ships against the existing Project trait, which is a real interface with real implementations rather than a speculative one. The port gets declared at stage 2, when wgpu supplies the second concrete use and the interface can be derived from two implementations instead of imagined from one.

This also removes cb-render-null: a null implementation of an interface that does not exist yet is a null implementation of nothing.

And it changes the pass's tier. The structural trigger for tier L was "creates a new capability port." This pass no longer creates one. That is recorded rather than acted on — the declaration and its roll stand, and the pass runs at the weight it declared. Re-rolling a tier because review made the work smaller would make the tier a function of the outcome, which is the one thing a tier declaration must not be. The CHAOS calibration window gets a second entry from this, and it is a more interesting one than the first: tier L at full weight deleted its own structural trigger.

C4 — the loopback server — conceded; controls carried to ADR-0007

The challenge is right that "loopback only" is not a boundary against a browser that also reads the internet, and right that "a page it emitted itself" is an assumption no code checks. All four controls are adopted as conditions on the implementation, and the fourth is the load-bearing one:

1. an unguessable token minted per process, required on every request;
2. Origin / Sec-Fetch-Site checked, rejected by default;
3. bound explicitly to 127.0.0.1;
4. a test that a request without the token is refused — and, per M-D1-MUT, a mutation that removes the check and turns that test red.

Controls 1–3 without 4 are three claims and no evidence, which is the class this project keeps finding in its own work.

C5 — the gate stops at the language boundary — conceded; both controls adopted

Naming a challenge in the survey and calling it pressed was not an answer, and the challenge says so correctly.

1. JavaScript may not construct commands. The page reports raw pointer facts; Rust decides what command they mean. JS becomes input transport, and the decision becomes testable in Rust against synthetic events.
2. The coverage gate crosses the boundary. The HTML counterpart to every_view_field_is_classified asserts over the parsed emitted document — the token is in the document, or the build fails. Asserting over the Rust that emits the document would reproduce CB-WP-0011's original defect one layer up.

C6 — the zeros — partly answered, partly conceded

Answered: the candidate measurements did carry the positive control the challenge says they lacked. measure.py tracks an unlocated list per candidate and it is empty for all seven — verified in results.json, not asserted. So no candidate figure is a silently-stopped harness.

Conceded, twice over:

• gap.py, which produced the C1 table, copied the measurement function without the guard. The C1 numbers therefore have no positive control. They are load-bearing now, since they are what withdrew the survey's main argument, so they must be re-measured under the guard before ADR-0007 cites them.
• The survey's HTML row is 0 by construction, not by measurement — there is no crate to fail to locate. The challenge is right that a reader cannot tell that zero from a dead one, and the survey printed them identically in a table whose other rows are measurements. It is relabelled rather than left to be read as a measured figure.

The general observation is worth keeping: a probe script that copies a tool's measurement function and not its controls is how a positive control gets lost, and it happened here inside one pass, in a repo whose whole discipline is positive controls.

---

What changed in the survey

• The "two orders of magnitude" framing is withdrawn; the real floor is fltk at 1.5× corrected headroom.
• The C1 candidates are folded in as measured rows, re-measured under the positive control.
• The recommendation's justification changes from affordability to allocation against stage 2's known 1,741,979-line bill.
• The AM-4 acquisition rule is stated, and it raises the cost of two candidates rather than lowering the cost of the recommended one.
• cb-render-api and cb-render-null are withdrawn from this pass.
• The HTML row is relabelled 0 by construction.
• C4 and C5's six controls become conditions in ADR-0007.
• AM-4a's incompatibility with stage 2 is raised as a maintainer decision and explicitly not decided here.

Approvable after these changes. The recommendation stands; the argument that reached it does not, and has been replaced.