Function should_demote 

pub fn should_demote(
    tier: Tier,
    pinned: bool,
    already_demoted: bool,
    frame_secs: impl Iterator<Item = f32>,
    budget_secs: f32,
) -> bool

The governor’s whole decision: whether to demote tier right now.

Pure — every input is a value, so the three properties ADR-0045 asks of the governor are unit-testable together rather than one being a fact about Renderer’s field layout: a pin never demotes, an already-demoted session never demotes again (the one-way latch), and only a sustained miss demotes.

The caller owns the latch: it sets its “demoted” flag and rebuilds when this says true, and passes that flag back in on every later frame. Keeping the flag out here is what makes “exactly once” a property of the decision instead of a property of the call site.