@hviana/sema 0.2.9 → 0.4.0

package/test/56-bridge-identity-admission.test.mjs

@@ -0,0 +1,209 @@
+// 56-bridge-identity-admission.test.mjs — the bridge's ZERO-SUBSTITUTION
+// admission: a candidate the alignment explains END TO END on BOTH sides,
+// separated from the query only by material that does not change what the
+// text SAYS, is the SAME learnt form and grounds through its own edge.
+//
+// "Material that does not change what it says" has ONE definition here, and
+// it is read from the corpus, never tuned (AGENTS §2.7, corpus-global
+// population): a span is EXPLAINED when it is sub-quantum (< W — typographic
+// glue) or every W-window in it is COMMON by the store's own climb (the
+// ascent saturates, or it reaches a majority of contexts).  A window that
+// reaches NOTHING is novel content and is never explained — the reading that
+// separates a droppable "the process of " from a load-bearing "heavy ".
+//
+// THE GAP THIS CLOSES (measured on the 17.9M-node trained store).  The query
+// `Who wrote Romeo and Juliet?` against the trained `Who wrote "Romeo and
+// Juliet"?` — two inserted quote characters — returned honest silence.  The
+// gist is a STRUCTURAL signature, so a mid-string insertion shifts every fold
+// boundary after it: the pair scored cos 0.377, BELOW unrelated neighbours
+// like "Who wrote the opera Carmen??" (0.603).  Recall's identity tier gates
+// on identityBar (0.969 at that length) and its reach tiers on 0.875, so no
+// gist-based tier could ever see it.  Only byte-exact alignment can — and the
+// bridge, which does exactly that, refused it for producing NO substitution.
+//
+// WHAT MUST NOT REGRESS (the documented prefix trap, bridge.ts): when the
+// query is a strict byte-PREFIX of several candidates that continue
+// differently, the bridge must still refuse — nothing corroborates picking
+// one continuation over another, and the surplus IS the invented answer.
+// The two shapes are separated by the candidate-side test: an identity
+// candidate has ≤ W bytes beyond the alignment, a prefix candidate has its
+// whole completion beyond it.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { Mind } from "../dist/src/index.js";
+import { SQliteStore } from "../dist/src/store-sqlite.js";
+
+const mk = () =>
+  new Mind({ seed: 1, store: new SQliteStore({ path: ":memory:" }) });
+
+/** Corroboration for the query's own windows: the bridge only aligns against
+ *  content whose W-windows are corpus-attested, so the fixture trains the
+ *  phrasing family, not one isolated sentence. */
+const TRAIN = [
+  ['Who wrote "Romeo and Juliet"?', " William Shakespeare wrote it."],
+  ['Who wrote "Hamlet"?', " William Shakespeare wrote it."],
+  ['Who wrote "Macbeth"?', " William Shakespeare wrote it."],
+  ["Who wrote the opera Carmen?", " Georges Bizet wrote it."],
+  ["Who wrote about Romeo and Juliet in an essay?", " A critic did."],
+];
+
+async function trained() {
+  const mind = mk();
+  await mind.ingest(TRAIN);
+  return mind;
+}
+
+test("1. a query differing only by typographic glue reaches the trained form", async () => {
+  const mind = await trained();
+  // Same form as the trained question, minus the two quote characters.
+  const a = await mind.respondText("Who wrote Romeo and Juliet?");
+  assert.match(
+    a,
+    /Shakespeare/,
+    `expected the trained continuation, got ${JSON.stringify(a)}`,
+  );
+  await mind.store.close();
+});
+
+test("2. the exact trained form still answers (no path was displaced)", async () => {
+  const mind = await trained();
+  const a = await mind.respondText('Who wrote "Romeo and Juliet"?');
+  assert.match(a, /Shakespeare/);
+  await mind.store.close();
+});
+
+test("3. a DIFFERENT trained question is not answered by its neighbour", async () => {
+  const mind = await trained();
+  const a = await mind.respondText("Who wrote the opera Carmen?");
+  assert.match(
+    a,
+    /Bizet/,
+    "the identity admission must not let a near neighbour stand in",
+  );
+  await mind.store.close();
+});
+
+test("4. PREFIX TRAP: a strict prefix of several candidates is still refused", async () => {
+  const mind = mk();
+  // Three facts sharing one prefix, each continuing differently.  A query
+  // that IS that prefix has no corroboration for any single completion; the
+  // candidate-side surplus is exactly the answer that would be invented.
+  await mind.ingest([
+    ["The capital city of France is Paris.", " It sits on the Seine."],
+    ["The capital city of Spain is Madrid.", " It sits on the Manzanares."],
+    ["The capital city of Italy is Rome.", " It sits on the Tiber."],
+  ]);
+  const a = await mind.respondText("The capital city of");
+  // Whatever the pipeline does with this, the bridge must not manufacture a
+  // country: an answer naming one of the three would be the invented
+  // completion the trap describes.
+  const named = ["Paris", "Madrid", "Rome"].filter((c) => a.includes(c));
+  assert.ok(
+    named.length !== 1 || a.includes("capital city of"),
+    `bridge invented a single completion (${named[0]}) for a bare prefix: ` +
+      JSON.stringify(a),
+  );
+  await mind.store.close();
+});
+
+test("5. honest silence survives — an unrelated query still grounds nothing", async () => {
+  const mind = await trained();
+  const a = await mind.respondText("What is the zorblatt frequency?");
+  assert.equal(
+    a.length,
+    0,
+    `expected silence, got ${JSON.stringify(a)} — the identity admission ` +
+      `must not lower the bar for unrelated content`,
+  );
+  await mind.store.close();
+});
+
+test("6. determinism: the admission is byte-exact, not scored", async () => {
+  const a = await trained();
+  const b = await trained();
+  const x = await a.respondText("Who wrote Romeo and Juliet?");
+  const y = await b.respondText("Who wrote Romeo and Juliet?");
+  assert.equal(x, y);
+  await a.store.close();
+  await b.store.close();
+});
+
+// ── The scaffolding reading ────────────────────────────────────────────────
+
+test("7. an omitted CORPUS-COMMON span is explained; a RARE one is not", async () => {
+  const { leafIdRun } = await import("../dist/src/mind/canonical.js");
+  const { corpusN, edgeAncestors } = await import(
+    "../dist/src/mind/traverse.js"
+  );
+  const { dominates } = await import("../dist/src/geometry.js");
+
+  const mind = mk();
+  const T = [];
+  for (const x of ["A", "B", "C", "D", "E", "F", "G", "H"]) {
+    T.push([`What is the process of ${x}ation?`, ` ${x}ation is a process.`]);
+    T.push([`Tell me the process of ${x}ing.`, ` ${x}ing is a process.`]);
+  }
+  T.push(["Is heavy water wet?", " No, heavy water is not wet."]);
+  await mind.ingest(T);
+
+  const N = corpusN(mind);
+  const W = mind.space.maxGroup;
+  // The predicate under test, mirrored exactly (bridge.ts explainedSpan).
+  const explained = (text) => {
+    const b = new TextEncoder().encode(text);
+    if (b.length < W) return true;
+    for (let o = 0; o + W <= b.length; o++) {
+      const ids = leafIdRun(mind, b, o, o + W);
+      if (ids === null) return false;
+      const wid = mind.store.findBranch(ids);
+      if (wid === null) return false;
+      const r = edgeAncestors(mind, wid, N);
+      if (r.saturated) continue;
+      if (r.roots.length === 0) return false;
+      if (!dominates(r.contextsReached, N)) return false;
+    }
+    return true;
+  };
+
+  assert.equal(
+    explained("the process of "),
+    true,
+    "corpus-common scaffolding must be droppable",
+  );
+  assert.equal(
+    explained("heavy "),
+    false,
+    "rare, discriminative content must NEVER be written off as scaffolding — " +
+      "a candidate omitting it answers a different, narrower question",
+  );
+  // The reading, not just the population: a window reaching NOTHING is novel
+  // content.  Going through reachOf (which maps both saturated and
+  // empty-rooted to Infinity) called "heavy " scaffolding and answered
+  // "Is water wet?" with "No, heavy water is not wet.".
+  assert.equal(
+    explained("zqxjwv "),
+    false,
+    "untrained content is never explained",
+  );
+  await mind.store.close();
+});
+
+test("8. EXACT query coverage — a sub-quantum query-side difference is NOT glue", async () => {
+  const mind = mk();
+  // A trained arithmetic fact, and a query differing from it only inside a
+  // sub-quantum span — but that span is DIGITS, and digits are content.
+  await mind.ingest([
+    ["what is 2+2?", " 2+2 is 4."],
+    ["what is 3+3?", " 3+3 is 6."],
+    ["what is 5+5?", " 5+5 is 10."],
+  ]);
+  const a = await mind.respondText("what is 2^10?");
+  assert.ok(
+    !a.includes("4."),
+    `answered a DIFFERENT arithmetic question: ${JSON.stringify(a)} — the ` +
+      `identity admission must require covered === query.length, with no ` +
+      `sub-quantum slack on the query side`,
+  );
+  await mind.store.close();
+});

package/test/57-fusion-order.test.mjs

@@ -0,0 +1,104 @@
+// 57-fusion-order.test.mjs — a fused multi-topic answer must READ in the
+// order the question posed its topics.
+//
+// fuseAttention sorts its pieces by `start`, their position in the query.
+// Every attention ROOT carries its own start.  `primary` did not: it was
+// given forest[0].start — the FIRST root's position — which is primary's own
+// source only when primary happens to come from that root.  When it does
+// not, primary sorts to a position it never occupied.
+//
+// Observed live on the 17.9M-node trained store:
+//   "What is the capital of France? And what is 2 + 2?"
+//     -> "4The capital city of France is Paris."
+// Both pieces were correct; only the order was wrong.  The ALU result, whose
+// evidence is the "2 + 2" span at the END of the query, had inherited the
+// France root's start of 0.
+//
+// primary's position is now the earliest query byte its own grounding stands
+// on: `accounted` when non-empty, else the computed span (a pure computation
+// is priced out of `accounted` by cover — the same cost-ladder-vs-coverage
+// distinction think() already draws for the fusion remainder).
+//
+// NOT under test: the missing separator between the pieces.  joinWithBridge
+// splices only a LEARNT connector; when the corpus holds none the pieces join
+// bare.  Inventing a space would synthesize bytes the store never saw, which
+// this system does not do — bare joining is the honest degradation.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { Mind } from "../dist/src/index.js";
+import { SQliteStore } from "../dist/src/store-sqlite.js";
+
+const mk = () =>
+  new Mind({ seed: 1, store: new SQliteStore({ path: ":memory:" }) });
+
+/** Two independent topics, each with its own trained fact, plus enough
+ *  same-frame neighbours that the consensus climb commits both as separate
+ *  points of attention rather than one. */
+const TRAIN = [
+  ["What is the capital of France?", " The capital of France is Paris."],
+  ["What is the capital of Spain?", " The capital of Spain is Madrid."],
+  ["What is the capital of Italy?", " The capital of Italy is Rome."],
+  ["What is the largest planet?", " The largest planet is Jupiter."],
+  ["What is the largest ocean?", " The largest ocean is the Pacific."],
+];
+
+async function trained() {
+  const mind = mk();
+  await mind.ingest(TRAIN);
+  return mind;
+}
+
+/** Index of `needle` in `hay`, or -1. */
+const at = (hay, needle) => hay.indexOf(needle);
+
+test("1. two fused topics appear in the query's own order", async () => {
+  const mind = await trained();
+  const a = await mind.respondText(
+    "What is the capital of France? And what is the largest planet?",
+  );
+  const iParis = at(a, "Paris"), iJup = at(a, "Jupiter");
+  if (iParis >= 0 && iJup >= 0) {
+    assert.ok(
+      iParis < iJup,
+      `France was asked FIRST but its answer trails: ${JSON.stringify(a)}`,
+    );
+  }
+  await mind.store.close();
+});
+
+test("2. reversing the question reverses the fused answer", async () => {
+  const mind = await trained();
+  const a = await mind.respondText(
+    "What is the largest planet? And what is the capital of France?",
+  );
+  const iParis = at(a, "Paris"), iJup = at(a, "Jupiter");
+  if (iParis >= 0 && iJup >= 0) {
+    assert.ok(
+      iJup < iParis,
+      `the planet was asked FIRST but its answer trails: ${JSON.stringify(a)}`,
+    );
+  }
+  await mind.store.close();
+});
+
+test("3. a single-topic answer is unchanged by the ordering rule", async () => {
+  const mind = await trained();
+  assert.match(
+    await mind.respondText("What is the capital of France?"),
+    /Paris/,
+  );
+  assert.match(
+    await mind.respondText("What is the largest planet?"),
+    /Jupiter/,
+  );
+  await mind.store.close();
+});
+
+test("4. determinism", async () => {
+  const a = await trained(), b = await trained();
+  const q = "What is the capital of France? And what is the largest planet?";
+  assert.equal(await a.respondText(q), await b.respondText(q));
+  await a.store.close();
+  await b.store.close();
+});

package/test/58-subquantum-sites.test.mjs

@@ -0,0 +1,112 @@
+// 58-subquantum-sites.test.mjs — at hub scale, a recognised form shorter
+// than one river window (W) is CHANCE, not evidence.
+//
+// recognition.emit is the single choke point every pass emits sites through
+// (structural subtree, chunk sub-runs, canonical leaf-id chains, edge trims).
+// Below W, byte overlap carries no identity information — the SAME quantum
+// floor identityBar prices ("below one river window, byte overlap is chance")
+// and the bridge's attestedQ applies ("spans shorter than W carry no window of
+// their own and can never substitute"). No new constant.
+//
+// Scoped to hub scale by the same `atomsAreHubs` switch that already guards
+// byte atoms, and for the same reason: on a SMALL store a two-byte fact is
+// genuine learnt content and its site is essential; on a large one every short
+// letter-run of every query becomes a "recognised form" that cover can hang an
+// edge off. A span covering the WHOLE query is exempt — then it is not a
+// coincidental fragment of something longer, it is the question.
+//
+// THE LIVE SHAPE (17.9M-node trained store): "In which country is the Eiffel
+// Tower?" recognised the form "hi" — the i=0 sub-run of the fold chunk "hich"
+// in "In w[hi]ch" — alongside "the" and "Eiffel Tower". The canonical pass's
+// own comment already names this coincidence ('"hi" resolving out of
+// "W[hi]ch"'). After this rule only "Eiffel Tower" survives.
+//
+// NOT claimed here: that removing those sites fixes that query. It does not —
+// see bench/README.md. Cover still grounds a greeting there through a 2-byte
+// span that does NOT come from `sites`. This test pins the site rule only.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { Mind } from "../dist/src/index.js";
+import { SQliteStore } from "../dist/src/store-sqlite.js";
+
+const mk = () =>
+  new Mind({ seed: 1, store: new SQliteStore({ path: ":memory:" }) });
+
+const enc = new TextEncoder();
+
+test("1. a sub-quantum coincidental substring is not a recognised site", async () => {
+  const mind = mk();
+  await mind.ingest([
+    ["hi", " Hello there, how can I help?"],
+    ["What is the capital of France?", " The capital of France is Paris."],
+    ["What is the capital of Spain?", " The capital of Spain is Madrid."],
+    ["What is the capital of Italy?", " The capital of Italy is Rome."],
+  ]);
+  const { recognise } = await import("../dist/src/mind/recognition.js");
+  const { atomIsHub, corpusN } = await import("../dist/src/mind/traverse.js");
+  const N = corpusN(mind);
+  const W = mind.space.maxGroup;
+  if (!atomIsHub(mind, N)) {
+    // Below hub scale the rule is deliberately inert — nothing to assert.
+    await mind.store.close();
+    return;
+  }
+  // "which" contains "hi" at an interior offset.
+  const q = enc.encode("In which country is the capital of France?");
+  const sites = recognise(mind, q).sites;
+  for (const s of sites) {
+    assert.ok(
+      s.end - s.start >= W || (s.start === 0 && s.end === q.length),
+      `sub-quantum site ${
+        JSON.stringify(
+          new TextDecoder().decode(q.subarray(s.start, s.end)),
+        )
+      } survived at hub scale`,
+    );
+  }
+  await mind.store.close();
+});
+
+test("2. a whole-query short form is EXEMPT — it is the question", async () => {
+  const mind = mk();
+  await mind.ingest([
+    ["hi", " Hello there, how can I help?"],
+    ["What is the capital of France?", " The capital of France is Paris."],
+    ["What is the capital of Spain?", " The capital of Spain is Madrid."],
+  ]);
+  const a = await mind.respondText("hi");
+  assert.match(
+    a,
+    /Hello there/,
+    "a short form that IS the whole query must still be answerable",
+  );
+  await mind.store.close();
+});
+
+test("3. long forms are untouched", async () => {
+  const mind = mk();
+  await mind.ingest([
+    ["What is the capital of France?", " The capital of France is Paris."],
+    ["What is the capital of Spain?", " The capital of Spain is Madrid."],
+  ]);
+  assert.match(
+    await mind.respondText("What is the capital of France?"),
+    /Paris/,
+  );
+  await mind.store.close();
+});
+
+test("4. determinism", async () => {
+  const run = async () => {
+    const m = mk();
+    await m.ingest([
+      ["hi", " Hello there, how can I help?"],
+      ["What is the capital of France?", " The capital of France is Paris."],
+    ]);
+    const a = await m.respondText("In which country is Paris?");
+    await m.store.close();
+    return a;
+  };
+  assert.equal(await run(), await run());
+});

package/test/59-fold-invariance.test.mjs

@@ -0,0 +1,226 @@
+// 59-fold-invariance.test.mjs — the fold's segmentation must be decided by
+// CONTENT, not by a byte's absolute position.
+//
+// `riverFold` groups fixed arity from byte 0 and permutes item k by seats[k],
+// k = index mod W.  Under that rule a byte's contribution — and therefore the
+// subtree its content sits in — is a function of where it happens to fall, so
+// the same content is a different node at a different offset.  Measured
+// consequences before this changed: recognition's site set moved with the
+// query's phase (period W); `What is the capital of France?` answered at pad
+// 0, 1, 4 and went silent at 2, 3, 5, 6, 7; and at pad 3 `In which country is
+// the Eiffel Tower?` answered with unrelated Malagasy text instead of
+// abstaining.  Semantic identity must not depend on W at all.
+//
+// `contentBoundaries` decides cuts with a rolling hash, so a change upstream
+// moves only the cut it falls inside.  These are the properties that buys, and
+// they are cheap to lose by accident — capping the segment length at W, for
+// instance, makes forced cuts dominate and silently restores the grid while
+// LEAVING EVERY OTHER TEST GREEN (it was measured at 14.3%, exactly the grid,
+// with the rest of the suite passing).  That is why invariance is asserted
+// here as a number rather than left implicit.
+//
+// Floors are set well under the measured values so ordinary drift does not
+// fail the suite, and far above the grid's 14.3% so a regression to positional
+// segmentation cannot pass.  Measured at the time of writing:
+//
+//     deposit-like text     96.7% cuts held / 94.5% segments identical
+//     non-Latin scripts     97.4% / 95.8%
+//     random binary         98.6% / 97.4%
+//     the arithmetic grid   14.3%   (only shifts of k ≡ 0 mod W survive)
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { bytesToTree, contentBoundaries } from "../dist/src/geometry.js";
+import { Alphabet } from "../dist/src/alphabet.js";
+import { makeKeyring, rng } from "../dist/src/vec.js";
+
+const D = 256;
+const W = 4;
+const mkSpace = () => ({
+  D,
+  seats: makeKeyring(D, Math.max(8, W), rng(1)),
+  rand: rng(2),
+  maxGroup: W,
+});
+const space = mkSpace();
+const alphabet = new Alphabet(7, D, { roughness: 0.65, seedMask: 0xa1fa17 });
+const enc = (s) => new TextEncoder().encode(s);
+
+const SAMPLES = [
+  "The Eiffel Tower is a wrought iron lattice tower located in Paris, France.",
+  "What is the capital of France? The capital of France is Paris.",
+  "Photosynthesis is the process by which plants convert light into energy.",
+  "Was ist die Hauptstadt von Deutschland? Die Hauptstadt ist Berlin.",
+  "Qual é a capital do Brasil? A capital do Brasil é Brasília.",
+  "水は水素と酸素からできています。これは化学の基本です。",
+];
+
+const segmentsOf = (bytes) => {
+  const edges = [0, ...contentBoundaries(space, bytes), bytes.length];
+  const out = [];
+  for (let i = 0; i + 1 < edges.length; i++) {
+    out.push(bytes.subarray(edges[i], edges[i + 1]));
+  }
+  return out;
+};
+const keyOf = (b) => Array.from(b).join(",");
+
+/** Shift each sample by 1..2W bytes and measure how much of the segmentation
+ *  downstream of the disturbance survives. */
+function invariance(samples) {
+  let cuts = 0, held = 0, segs = 0, segsHeld = 0;
+  for (const bytes of samples) {
+    const base = contentBoundaries(space, bytes);
+    const baseSegs = new Set(segmentsOf(bytes).map(keyOf));
+    for (let k = 1; k <= 2 * W; k++) {
+      const padded = new Uint8Array(k + bytes.length);
+      padded.set(enc(" ".repeat(k)));
+      padded.set(bytes, k);
+      const moved = new Set(contentBoundaries(space, padded));
+      // Only cuts past the disturbed head are expected to survive.
+      const expected = base.filter((c) => c > 2 * W).map((c) => c + k);
+      cuts += expected.length;
+      held += expected.filter((c) => moved.has(c)).length;
+      // Segment identity, skipping the two segments covering the change.
+      for (const s of segmentsOf(padded).slice(2)) {
+        segs++;
+        if (baseSegs.has(keyOf(s))) segsHeld++;
+      }
+    }
+  }
+  return { cutRatio: held / cuts, segRatio: segsHeld / segs };
+}
+
+test("content cuts survive a byte shift; the arithmetic grid does not", () => {
+  const { cutRatio, segRatio } = invariance(SAMPLES.map(enc));
+  assert.ok(
+    cutRatio >= 0.85,
+    `downstream cuts held ${
+      (cutRatio * 100).toFixed(1)
+    }% — below the 85% floor; ` +
+      `at 14.3% the fold has degenerated to the arithmetic grid`,
+  );
+  assert.ok(
+    segRatio >= 0.8,
+    `segments byte-identical ${
+      (segRatio * 100).toFixed(1)
+    }% — below the 80% floor`,
+  );
+
+  // The grid, same corpus, as the control this floor is meaningful against.
+  const gridCuts = (b) => {
+    const out = [];
+    for (let i = W; i < b.length; i += W) out.push(i);
+    return out;
+  };
+  let gCuts = 0, gHeld = 0;
+  for (const bytes of SAMPLES.map(enc)) {
+    const base = gridCuts(bytes);
+    for (let k = 1; k <= 2 * W; k++) {
+      const padded = new Uint8Array(k + bytes.length);
+      padded.set(bytes, k);
+      const moved = new Set(gridCuts(padded));
+      const expected = base.filter((c) => c > 2 * W).map((c) => c + k);
+      gCuts += expected.length;
+      gHeld += expected.filter((c) => moved.has(c)).length;
+    }
+  }
+  const gridRatio = gHeld / gCuts;
+  assert.ok(
+    gridRatio < 0.3,
+    `control: the grid should lose most cuts under a shift, got ${
+      (gridRatio * 100).toFixed(1)
+    }%`,
+  );
+  assert.ok(
+    cutRatio > gridRatio * 2,
+    `content cuts (${(cutRatio * 100).toFixed(1)}%) must beat the grid ` +
+      `(${(gridRatio * 100).toFixed(1)}%) by a wide margin`,
+  );
+});
+
+test("segmentation reads bytes, not text — random binary behaves like prose", () => {
+  // Mind is not a text engine; the same fold carries grids and any other
+  // modality.  A boundary rule that only worked on prose would be importing an
+  // assumption the architecture rejects.
+  let s = 12345;
+  const rnd = () => (s = (Math.imul(s, 1103515245) + 12345) >>> 0) / 2 ** 32;
+  const binary = Array.from({ length: 40 }, () => {
+    const n = 40 + Math.floor(rnd() * 300);
+    return Uint8Array.from({ length: n }, () => Math.floor(rnd() * 256));
+  });
+  const { cutRatio, segRatio } = invariance(binary);
+  assert.ok(
+    cutRatio >= 0.85,
+    `random binary cuts held ${
+      (cutRatio * 100).toFixed(1)
+    }% — the rule must not depend on text`,
+  );
+  assert.ok(
+    segRatio >= 0.8,
+    `random binary segments ${(segRatio * 100).toFixed(1)}%`,
+  );
+});
+
+test("segment lengths stay within the write side's declared unit scale", () => {
+  // The minimum is W−1 (canonicalWindows' straddle neighbour, the write side's
+  // own floor for a unit) and the maximum is the keyring's seat count, because
+  // a segment folds as ONE flat node and `fold` has exactly that many seats.
+  // A segment outside that range cannot be bound into seats at all.
+  const maxLen = space.seats.length;
+  for (const bytes of SAMPLES.map(enc)) {
+    const segs = segmentsOf(bytes);
+    for (const s of segs) {
+      assert.ok(
+        s.length <= maxLen,
+        `segment of ${s.length} bytes exceeds the ${maxLen} available seats`,
+      );
+      assert.ok(s.length >= 1, "empty segment");
+    }
+    assert.equal(
+      segs.reduce((a, x) => a + x.length, 0),
+      bytes.length,
+      "segments must tile the stream exactly",
+    );
+  }
+});
+
+test("the fold stays shallow — no left-nested spine", () => {
+  // Joining segments left-nested costs a node per segment on ONE spine: at a
+  // cut every ~6 bytes a 3 KB stream became a 450-deep chain of 450 fresh
+  // D-vectors, ~1.8 MB for a single deposit, and every walker above inherited
+  // the depth.  Grouping recurses by cut LEVEL instead, so depth stays
+  // logarithmic in the stream length.
+  const base = "The Eiffel Tower is a wrought iron lattice tower in Paris. ";
+  for (const reps of [1, 8, 40]) {
+    const bytes = enc(base.repeat(reps));
+    const tree = bytesToTree(space, alphabet, bytes);
+    let depth = 0, nodes = 0;
+    const stack = [[tree, 1]];
+    while (stack.length) {
+      const [n, d] = stack.pop();
+      nodes++;
+      if (d > depth) depth = d;
+      if (n.kids !== null) { for (const k of n.kids) stack.push([k, d + 1]); }
+    }
+    // Generous: 4x the ideal log_W depth still catches a linear spine by an
+    // enormous margin (a 2.3 KB stream would spine to ~400).
+    const ideal = Math.ceil(Math.log(bytes.length) / Math.log(W));
+    assert.ok(
+      depth <= ideal * 4,
+      `depth ${depth} over ${bytes.length} bytes (river ideal ~${ideal}) — a spine, not a tree`,
+    );
+    assert.ok(
+      nodes < bytes.length * 2,
+      `${nodes} nodes for ${bytes.length} bytes — the fold should not multiply nodes`,
+    );
+  }
+});
+
+test("the fold is deterministic — identical bytes, identical cuts", () => {
+  for (const bytes of SAMPLES.map(enc)) {
+    const a = contentBoundaries(space, bytes);
+    const b = contentBoundaries(mkSpace(), Uint8Array.from(bytes));
+    assert.deepEqual(a, b, "the same bytes must always cut the same way");
+  }
+});