docs(observability): record #801 mount baseline

docs/archive/2026-08-26-issue-801-csr-mount-cost.md

@@ -0,0 +1,92 @@
+# Issue #801 — Cut CSR mount cost
+
+## Outcome
+
+Jaunder either reduces the Firefox critical path for an owned part of CSR page
+boot or post-mount settling, or closes #801 with certified evidence that no
+issue-local candidate can meet the registered navigation and suite thresholds.
+Neither outcome weakens authentication, delays operator safety warnings, or
+regresses Chromium.
+
+## Load-bearing decisions
+
+- Fresh measurements decide the lever. The baseline includes both the
+  document-frame boot breakdown and `mountToSettledMs`; `commitToMountMs` is
+  reported but is never decomposed across clock frames (ADR-0100).
+- The deciding environment is SQLite, one worker, and Firefox. Chromium is the
+  no-regression control. Gate settings may be reported separately but do not
+  replace the one-worker comparison.
+- The baseline freezes a finite candidate list before the first experiment. A
+  candidate is eligible only when it targets an issue-local, Jaunder-owned
+  phase, its predicted removable ceiling exceeds the baseline uncertainty for
+  both the affected-navigation phase and suite wall clock, and no separate issue
+  owns or has disposed it. The record names the affected route, cache-warmth
+  population, target phase, mechanism signal, and predicted ceiling. Cold and
+  warm populations are reported separately.
+- Each comparison uses the same test corpus and configuration, a quiescent host,
+  distinct `e2eSalt` values, counterbalanced or interleaved arm order, and at
+  least three runs per arm. If baseline variance requires more runs, the fixed
+  count is chosen before candidate capture.
+- The pass calculation is registered before capture and uses unpaired run-level
+  arm means. For each browser and metric, the noise floor is three times
+  `sqrt(baseline_variance / baseline_runs + candidate_variance / candidate_runs)`.
+  A candidate succeeds only when both its affected-navigation phase and the
+  unchanged suite wall clock improve beyond their Firefox floors. Chromium must
+  not regress beyond its own phase or suite floor.
+- Candidates are attempted in descending predicted ceiling. A phase already
+  disposed or separately owned by #836, #864, #867, #869, or #870 is recorded
+  and excluded rather than duplicated. ADR-0106's raw wasm size budget and
+  ADR-0121's no-preload decision remain in force.
+- The authoritative session reconcile remains ahead of the authenticated `/app`
+  timeline request. The advisory marker never authorizes a speculative protected
+  fetch.
+- `BackupBanner` and `SiteBaseUrlBanner` remain prompt shell safety signals.
+  Work may eliminate, combine, cache, or conditionally avoid their underlying
+  cost only when visibility and authorization semantics remain intact; merely
+  scheduling them after the measured boundary is not a performance win.
+- A candidate that misses either Firefox floor or regresses Chromium is reverted
+  and recorded as a negative result before the next candidate on the frozen list
+  is attempted.
+- If the frozen list is empty, or every candidate on it fails, the certified
+  negative evidence completes #801 as no actionable win. It does not land
+  measurement-only delay, an under-noise change, or work owned by another issue.
+
+## Acceptance
+
+- The baseline certifies complete trace populations and reports, per relevant
+  navigation, the boot phase fields and `mountToSettledMs`, split by browser,
+  affected route, and cache warmth.
+- The frozen candidate list, each predicted mechanism and ceiling, the
+  candidate-specific integrity signal, the floor calculation, run count, and
+  realized arm order are recorded before results are interpreted.
+- If the frozen list is non-empty, matched before/after traces show a Firefox
+  improvement greater than the calculated floor for both the affected-navigation
+  phase and unchanged-suite wall clock; Chromium stays within its calculated
+  no-regression bounds.
+- For an attempted candidate, the registered mechanism signal moves in the
+  predicted direction and proves the targeted work was removed or made cheaper.
+  Request counts and ordering additionally prove that any request-graph result
+  was not shifted beyond the settled boundary; boot work uses its document-frame
+  marks and direct wasm or resource diagnostics instead.
+- If the frozen list is empty, the record demonstrates that every otherwise
+  material lever is disposed, separately owned, or below the suite eligibility
+  floor, and #801 closes without a behavior change.
+- Any behavior change retains tests proving that `/app` waits for authoritative
+  session reconciliation, rejects an invalid or stale advisory marker, and
+  preserves operator-warning behavior at the shell routes where it is currently
+  visible. Any changed observable contract has a focused regression test that
+  fails under the prior behavior.
+- `docs/observability.md` records the protocol, certified corpus, result,
+  limitations, and disposition of every attempted candidate.
+- The focused behavioral checks and the repository's normal implementation gate
+  pass before the change is committed; the final branch passes the ship gate.
+
+## Boundaries
+
+- No weakening of authentication, public-projector cacheability, the one-boot
+  e2e invariant, telemetry PII rules, or backend/browser parity.
+- No preload revival, timeout increase, warning suppression, metric-boundary
+  manipulation, or unrelated navigation-count work.
+- No new performance budget, architecture boundary, public API, domain term, or
+  ADR is introduced by this issue.
+- Negative experiments may be documented, but their code does not land.

docs/observability.md

@@ -1937,6 +1937,118 @@ Corpus: `~/measurements/jaunder/issue-867-navcount/`. Deciding-set files are
 unprefixed, confirming-set files carry a `gate-` prefix, and the README opens
 with a table naming both sets and stating that they must not be pooled.
 
+## #801 — CSR mount-cost baseline found no eligible experiment (2026-08-26)
+
+**Verdict: the frozen candidate list is empty.** The current issue contract
+requires a change to clear both an affected-navigation floor and unchanged-suite
+wall-clock floor on Firefox. Fresh data leaves no issue-local, Jaunder-owned
+candidate with a defensible suite ceiling above the Firefox floor. No
+under-noise change or measurement-boundary shift was attempted.
+
+### Protocol and certification
+
+The deciding corpus is SQLite, single-worker, five runs per browser on a
+reserved host. Each pair used a distinct `e2eSalt`; browser order was
+counterbalanced run-by-run:
+
+1. Firefox → Chromium
+2. Chromium → Firefox
+3. Firefox → Chromium
+4. Chromium → Firefox
+5. Firefox → Chromium
+
+The first, mistakenly concurrent dry pair is not part of the corpus. Every
+included browser/run has the same census: **241 navigation records** (215
+`e2e.test` default-page plus 26 `e2e.page` secondary-page), **234 complete
+document-frame boot-mark sets**, **11 `mountToSettledMs` values**, and
+`e2e.navigation_top_dropped = 0`.
+
+Corpus: `~/measurements/jaunder/issue-801-csr-mount/baseline/`.
+`playwright-report-*.json` supplies suite wall clock; the extracted JSONL traces
+supply navigation metrics. The salt was restored to the committed empty value
+after capture.
+
+### Suite floor
+
+The pass rule uses unpaired run-level arm means. Before a candidate exists, the
+eligibility proxy is three times the baseline standard error:
+
+| browser  | Playwright suite durations (ms)        | mean (ms) | sample SD (ms) | baseline 3×SE (ms) |
+| -------- | -------------------------------------- | --------- | -------------- | ------------------ |
+| Firefox  | 722332, 628740, 642650, 653065, 645312 | 658420    | 36793          | **49363**          |
+| Chromium | 410158, 407728, 409880, 415436, 415027 | 411646    | 3409           | **4573**           |
+
+The high first Firefox observation remains in the registered population; there
+is no post-hoc outlier exclusion. Increasing from three to five runs reduced the
+Firefox eligibility floor from 87.5 s to 49.4 s, but did not make an issue-local
+candidate eligible.
+
+### What the two measurement frames say
+
+`/app` has 15 navigation records per browser/run: 14 cold and one warm. Only 13
+cold records per run are mounted with a complete document boot total and all
+three Rust boot phases; the remaining cold record and the warm record have no
+mounted timing. **No `/app` record has `mountToSettledMs` in any of the ten
+browser runs.** The post-mount request graph therefore cannot be sized from this
+corpus without inventing missing values.
+
+The run-level `/app` means keep the measurement frames separate. The 3×SE
+columns are baseline-only eligibility proxies, not candidate pass floors:
+
+| browser  | warmth | navigations/run | complete/run | `commitToMountMs` mean / 3×SE | document boot mean / 3×SE | settled/run |
+| -------- | ------ | --------------- | ------------ | ----------------------------- | ------------------------- | ----------- |
+| Firefox  | cold   | 14              | 13           | 1091.9 / 85.0 ms              | 832.9 / 79.7 ms           | 0           |
+| Firefox  | warm   | 1               | 0            | —                             | —                         | 0           |
+| Chromium | cold   | 14              | 13           | 800.3 / 39.7 ms               | 411.8 / 8.3 ms            | 0           |
+| Chromium | warm   | 1               | 0            | —                             | —                         | 0           |
+
+`commitToMountMs` is reported but not decomposed: it is Node-frame wall time,
+while document boot and its phases are document-frame values (ADR-0100).
+
+The complete `mountToSettledMs` population is limited to these route/warmth
+groups, pooled across five runs per browser:
+
+| route        | warmth | n/browser | Firefox mean | Chromium mean |
+| ------------ | ------ | --------- | ------------ | ------------- |
+| `/profile`   | cold   | 25        | 273.7 ms     | 300.3 ms      |
+| `/profile`   | warm   | 15        | 271.7 ms     | 298.6 ms      |
+| `/login`     | cold   | 5         | 357.2 ms     | 318.4 ms      |
+| `/posts/new` | cold   | 5         | 255.0 ms     | 148.0 ms      |
+| `/admin/*`   | warm   | 5         | 294.2 ms     | 302.0 ms      |
+
+Those 11 values per run sum to only 3.09 s/run on Firefox (3.17 s on Chromium);
+even deleting that entire measured quantity cannot clear the 49.4 s Firefox
+suite floor.
+
+The `/app` document-frame boot total averages 832.9 ms on Firefox. Its Rust-side
+phase objects exist on all 75 `/app` records and are not the cost: entry→seed
+parsed averages 0.04 ms, seed parsed→render start 0.17 ms, and render
+start→mount done 2.39 ms. The material boot phases are already disposed or owned
+elsewhere:
+
+| phase or lever                            | observed or historical suite ceiling | disposition                         |
+| ----------------------------------------- | ------------------------------------ | ----------------------------------- |
+| raw wasm-size reduction                   | ~14.5 s Firefox                      | #836 completed; ADR-0106 budget     |
+| Firefox size-independent initialization   | engine floor                         | #864 completed                      |
+| navigation-count reduction                | ~65 s Firefox                        | #867 completed                      |
+| content-hashed `/pkg/*` caching           | ~11.8 s Firefox                      | #869 open, separately owned         |
+| stylesheet/pre-fetch window               | ~54.4 s Firefox                      | #870 completed                      |
+| wasm preload                              | prior trial missed its floor         | rejected by ADR-0121                |
+| warning/session/timeline post-mount graph | incomplete population; no ceiling    | cannot be admitted from this corpus |
+
+The two levers whose historical ceilings exceed 49.4 s are #867 and #870; both
+already landed under their own issues. The remaining issue-local request graph
+has neither a complete deciding population nor a ceiling capable of satisfying
+the dual threshold.
+
+### Disposition
+
+The pre-registered eligibility rule admits **no candidate**, so there is no
+first experiment and no behavior change to test. The approved scope disposition
+closes #801 as no actionable win rather than absorbing separately owned work,
+weakening authentication, delaying operator warnings, or landing a change the
+suite clock cannot resolve.
+
 ## #792 — the per-test warmup A/B (findings, 2026-08-04)
 
 **Verdict: delete the warmup, both browsers.** It costs 113 s/combo (chromium)