clay-borg/history/260802-render-port-response.md

# 260802 — response to the challenge on CB-RES-0006

One round, per InnerLoop §Step 2. Four challenges conceded, two answered
with evidence, and one of the concessions turned up something larger than
this pass.

---

## C1 — the unmeasured interval — **conceded, and the framing withdrawn**

The challenge is right and the survey's rhetoric was wrong. "Two orders of
magnitude" described the candidates I picked, and I picked them from what a
2026 Rust developer reaches for, which is a list of GPU-era stacks. The
real floor for a windowed toolkit is `fltk` at **140,079** marginal lines —
**1.5×** the corrected headroom, not 128×.

The C1 table is folded into the survey as measured data, including
`tiny-skia` at 83,956, which fits inside 92,798 and disproves the interval
claim by itself.

**So dependency cost alone does not decide this.** The survey's argument as
written is withdrawn. What replaces it is an allocation argument, and it is
stronger:

INTENT stage 2 names `wgpu` explicitly. That is a **1,741,979-line**
marginal cost, already measured, already unavoidable, and it arrives one
stage from now. Against that, spending 1.5× the entire remaining budget on
a stage-1 windowing toolkit that stage 2 immediately discards is the wrong
allocation — not because it does not fit, but because it buys a thing with
a known expiry using money already committed elsewhere.

That argument does not need AM-4a's target to be exactly 250,000. It only
needs stage 2's bill to be larger than stage 1's benefit, which is
measured, and true by a factor of twelve.

## C1b — what the concession exposed: **AM-4a cannot survive stage 2**

Following C1 honestly produces a finding neither the survey nor the
challenge was looking for.

| | marginal lines |
|---|---:|
| AM-4a target, total | 250,000 |
| current shipped-runtime (corrected, proc-macro excluded) | 157,202 |
| headroom | 92,798 |
| `wgpu` + `winit`, which INTENT stage 2 names by name | **1,741,979** |

Stage 2 exceeds the entire AM-4a target by **7×**, and exceeds the
remaining headroom by **19×**. No sequencing, no feature-gating and no
metric correction closes a gap that size. **AM-4a as targeted is
incompatible with INTENT as written**, and has been since both were
written; nothing in this pass caused it.

That is a maintainer's decision, not mine — either the target moves, or the
port stays out of the AM-4a configuration by an argued rule, or stage 2
changes. It is recorded here and carried to the evidence file, and it is
deliberately **not** resolved by this pass, because a pass that discovers a
budget conflict and also decides it has reviewed nothing.

It does, however, retire one bad reason for the recommendation. "HTML,
because we cannot afford anything else" is false. "HTML, because stage 1
should not spend stage 2's money on something stage 2 throws away" is true.

## C2 — the metric is gameable by relocation — **conceded; one rule, stated**

The challenge is right that the survey scored the browser at zero on an
axis chosen to produce zero, and right that the same move already makes
`sdl2` and `fltk` look cheap in the survey's own table. I had not noticed,
because I had measured no bindings.

The rule, which belongs in AM-4's definition and not in this pass's
reasoning, applied consistently to all three:

> **AM-4 counts third-party code the project causes to be acquired.** It
> does not count runtimes the user already has independently of us — the
> kernel, the system C library, the shell, the terminal, a web browser. It
> *does* count a library our build or install instructions cause to be
> fetched, pinned, or linked, whether or not its source is Rust.

Under that rule, consistently:

- a **browser** is not counted — nothing we ship or instruct causes it to
  be acquired;
- **`sdl2`/`fltk`** are counted at more than their Rust binding, not less —
  they oblige a user to install a `-dev` package they would not otherwise
  have, so the survey's 191,973 and 140,079 **understate** them;
- and the rule makes the metric *harder* to satisfy by relocation, not
  easier, which is the direction a rule proposed by the party it benefits
  has to go before it is worth anything.

This makes the HTML row honest rather than merely favourable. It also
means the survey's table understates two candidates, and that correction is
folded in.

## C3 — the port contradicts the second-use rule — **conceded entirely**

Recommendations 1 and 4 cannot both stand, and 4 is the one INTENT
supports. `CommitWindow` is already in this repo with a delete-by date for
exactly this mistake.

**`cb-render-api` is withdrawn from this pass.** `cb-render-html` ships
against the existing `Project` trait, which is a real interface with real
implementations rather than a speculative one. The port gets declared at
stage 2, when `wgpu` supplies the second concrete use and the interface can
be derived from two implementations instead of imagined from one.

This also removes `cb-render-null`: a null implementation of an interface
that does not exist yet is a null implementation of nothing.

**And it changes the pass's tier.** The structural trigger for tier L was
"creates a new capability port." This pass no longer creates one. That is
recorded rather than acted on — the declaration and its roll stand, and the
pass runs at the weight it declared. Re-rolling a tier because review made
the work smaller would make the tier a function of the outcome, which is
the one thing a tier declaration must not be. **The CHAOS calibration
window gets a second entry from this**, and it is a more interesting one
than the first: tier L at full weight deleted its own structural trigger.

## C4 — the loopback server — **conceded; controls carried to ADR-0007**

The challenge is right that "loopback only" is not a boundary against a
browser that also reads the internet, and right that "a page it emitted
itself" is an assumption no code checks. All four controls are adopted as
conditions on the implementation, and the fourth is the load-bearing one:

1. an unguessable token minted per process, required on every request;
2. `Origin` / `Sec-Fetch-Site` checked, rejected by default;
3. bound explicitly to `127.0.0.1`;
4. **a test that a request without the token is refused** — and, per
   M-D1-MUT, a mutation that removes the check and turns that test red.

Controls 1–3 without 4 are three claims and no evidence, which is the
class this project keeps finding in its own work.

## C5 — the gate stops at the language boundary — **conceded; both controls adopted**

Naming a challenge in the survey and calling it pressed was not an answer,
and the challenge says so correctly.

1. **JavaScript may not construct commands.** The page reports raw pointer
   facts; Rust decides what command they mean. JS becomes input transport,
   and the decision becomes testable in Rust against synthetic events.
2. **The coverage gate crosses the boundary.** The HTML counterpart to
   `every_view_field_is_classified` asserts over the *parsed emitted
   document* — the token is in the document, or the build fails. Asserting
   over the Rust that emits the document would reproduce CB-WP-0011's
   original defect one layer up.

## C6 — the zeros — **partly answered, partly conceded**

**Answered:** the candidate measurements did carry the positive control the
challenge says they lacked. `measure.py` tracks an `unlocated` list per
candidate and it is empty for all seven — verified in `results.json`, not
asserted. So no candidate figure is a silently-stopped harness.

**Conceded, twice over:**

- `gap.py`, which produced the C1 table, copied the measurement function
  **without** the guard. The C1 numbers therefore have no positive control.
  They are load-bearing now, since they are what withdrew the survey's main
  argument, so they must be re-measured under the guard before ADR-0007
  cites them.
- The survey's HTML row is **0 by construction, not by measurement** —
  there is no crate to fail to locate. The challenge is right that a
  reader cannot tell that zero from a dead one, and the survey printed them
  identically in a table whose other rows are measurements. It is relabelled
  rather than left to be read as a measured figure.

The general observation is worth keeping: a probe script that copies a
tool's measurement function and not its controls is how a positive control
gets lost, and it happened here inside one pass, in a repo whose whole
discipline is positive controls.

---

## What changed in the survey

- The "two orders of magnitude" framing is **withdrawn**; the real floor is
  `fltk` at 1.5× corrected headroom.
- The C1 candidates are folded in as measured rows, re-measured under the
  positive control.
- The recommendation's justification changes from *affordability* to
  *allocation against stage 2's known 1,741,979-line bill*.
- The AM-4 acquisition rule is stated, and it **raises** the cost of two
  candidates rather than lowering the cost of the recommended one.
- **`cb-render-api` and `cb-render-null` are withdrawn from this pass.**
- The HTML row is relabelled *0 by construction*.
- C4 and C5's six controls become conditions in ADR-0007.
- **AM-4a's incompatibility with stage 2 is raised as a maintainer
  decision** and explicitly not decided here.

**Approvable after these changes.** The recommendation stands; the argument
that reached it does not, and has been replaced.