Function tier_change_permitted 

pub fn tier_change_permitted(has_surface: bool) -> bool

Whether a runtime tier change is allowed at all (ADR-0054): only on a context that has a surface.

A surface-less context is exactly the headless capture path, and ADR-0045’s guarantee is that a capture is Tier::Floor by construction — Renderer::new_headless takes no tier argument, so no baseline can be blessed at another tier by forgetting a field. Renderer::set_tier is a public mutator on the very type the golden suite renders through, so it is the one hole that guarantee was shaped to exclude, and this predicate is what keeps it closed.

Pure, and separate from set_tier, deliberately. A Renderer with a surface cannot be constructed in CI — there is no window — so a test that only observed the headless no-op would pass equally well against a set_tier that did nothing at all. Expressed as a value-in/value-out function, both directions are assertable.