The Residual

Every change in these three horizons stops at the same line: none of them watches how content behaves on a user's own device at the moment the screen is drawn.

Where you check a resource, you check it as it was delivered rather than as it behaves, because every check you can deploy runs before the code does and the code runs afterward. Where you observe behavior, you observe it on a copy served to an observer, and any condition that observer does not carry is a condition it cannot see. And afterward there is usually nothing left to examine, because the substituted resource lived in memory for one session and whoever served it decides whether the client keeps a copy at all.

Runtime behavioral monitoring at the rendering layer is the control that would cross that line. It exists today only in narrow forms: in-browser script-behavior telemetry, sandboxing layers that watch a subset of API calls, output checks against fixed rules. As a default capability of a client runtime it exists nowhere, on any device class. Building it is an engineering problem rather than a mystery, and part of what holds it back is economic, because inspecting what running code has changed, as fast as the runtime changes it, costs the processing, memory and energy this whole design exists to push onto somebody else's device.

So write the gap down and keep it where the people who fund the work can see it. In a risk register it reads as one sentence: rendered content is not behaviorally verified on any surface this organization operates, and no standard capability currently closes that gap. Written that way it is not an admission of failure. It is what keeps the work funded until somebody ships the capability that retires it.

Everything in these three horizons is what an organization does about a vulnerability nobody can patch. Fewer parties reach the Glass, each one is named and watched, a second path to the truth stands behind every screen that moves money or equipment, and the requirement for what nobody sells yet is stated out loud, in procurement, in standards rooms and in research agendas. That is not the whole answer. It is the part available now, and an organization that has done it is the one still standing when the rest arrives.