@hviana/sema 0.5.7 → 0.5.9

package/src/mind/recognition.ts

@@ -15,7 +15,7 @@ import {
   perceive,
   resolve,
 } from "./primitives.js";
-import { atomIsHub, corpusN, leadsSomewhere } from "./traverse.js";
+import { atomIsHub, bearsEdge, corpusN, leadsSomewhere } from "./traverse.js";
 import { chainReach, leafIdAt, leafIdRun } from "./canonical.js";
 import { canonHash } from "../canon.js";
 import { isChunk, type Sema } from "../sema.js";
@@ -594,6 +594,31 @@ function recogniseImpl(ctx: MindContext, bytes: Uint8Array): Recognition {
   // "Eiffel Tower" site vanished with it).  The premise is wrong but the
   // trust it stood in for is real; a replacement signal is still open work.
   // See bench/README.md.
+  //
+  // THE REPLACEMENT SIGNAL (2026-08-13): `leadsSomewhere` on the BYTE-EXACT
+  // branch the chain already found.  The blanket off-boundary suppression is
+  // a decision that CHANGES WITH CORPUS SIZE — `atomsAreHubs` flips at
+  // N = 4096 (atomReach = ⌈N·W/256⌉ exceeds √N there) — so a store crossing
+  // that point silently loses interior sites it used to have.  Measured: with
+  // the two-hop chain deposited, `recognise("The country of Eiffel Tower is
+  // France.")` yields 4 sites including `France` at N = 3920 and 2 sites
+  // without it at N = 4227; the pivot dies with the site and multi-hop goes
+  // silent from there up (the trained store is N = 325,615).
+  //
+  // The honest gate is the one `emit` already applies, moved EARLIER and paid
+  // for with existence probes instead of a fold: `findBranch` has already
+  // proved these bytes are a stored branch, so the only remaining question is
+  // whether that branch is a deposited whole (bears an edge or a halo) or an
+  // interned fragment.  "hi" out of "W[hi]ch" leads nowhere and is still
+  // suppressed; `France` bears both and is admitted.  Structural, not scalar
+  // — no constant enters and nothing reads N, so the verdict no longer moves
+  // when the corpus grows.
+  //
+  // COST: `bearsEdge` is the response-MEMOISED edge probe, not the full
+  // `leadsSomewhere` — its uncached `hasHalo` tier took haloProbes from 922 to
+  // 9,144 on a nine-query battery over the trained store, which is not a price
+  // this pass may charge.  `emit` still applies the full predicate, so this is
+  // a pre-filter that never widens what is admitted.
   const tryChain = (
     p: number,
     maxIds: number,
@@ -610,8 +635,9 @@ function recogniseImpl(ctx: MindContext, bytes: Uint8Array): Recognition {
       if (!nx) break;
       ids.push(nx.id);
       pos = nx.end;
-      if (store.findBranch(ids) === null) continue;
-      if (!boundary && atomsAreHubs) continue;
+      const branch = store.findBranch(ids);
+      if (branch === null) continue;
+      if (!boundary && atomsAreHubs && !bearsEdge(ctx, branch)) continue;
       const id = resolveSpan(p, pos);
       if (id === null || id === prevId) continue;
       prevId = id;

package/src/mind/traverse.ts

@@ -461,6 +461,25 @@ export function atomIsHub(ctx: MindContext, contextCount: number): boolean {
   return atomReach(ctx, contextCount) > boundFor(contextCount);
 }
 
+/** Cached "does this node bear a continuation edge?" — the CHEAP half of
+ *  {@link leadsSomewhere}, exported for hot paths that must PRE-FILTER a
+ *  candidate before paying for a fold and cannot afford the halo tier.
+ *
+ *  `leadsSomewhere`'s second tier (`hasHalo`) is deliberately uncached — one
+ *  indexed point probe per candidate, which is right where candidates are
+ *  already few.  On recognition's off-boundary chain pass they are not few:
+ *  using the full predicate there took haloProbes from 922 to 9,144 on a
+ *  nine-query battery over the trained store.  The edge tier alone is memoised
+ *  for the response, so it is ~free, and a node bearing an edge is exactly the
+ *  "deposited whole, not an interned fragment" claim that pass needs.
+ *
+ *  Strictly NARROWER than `leadsSomewhere` — a halo-only node reads false — so
+ *  it is sound as a pre-filter before a consumer that applies the full
+ *  predicate, and never as a replacement for it. */
+export function bearsEdge(ctx: MindContext, id: number): boolean {
+  return cachedHasNext(ctx, id, getStructCache(ctx));
+}
+
 /** Whether a node LEADS SOMEWHERE — it bears a continuation edge or a halo.
  *  The admission predicate recognition filters sites with (HOW_IT_WORKS
  *  §15.3): a form that leads nowhere contributes nothing to any derivation.
@@ -558,6 +577,35 @@ export function contains(
   return false;
 }
 
+/** Whether a continuation edge joins the two forms, in either direction —
+ *  the EXACT half's veto on calling them synonyms.
+ *
+ *  Halos measure company, and the strongest company any two forms can keep is
+ *  standing next to each other: a question and its answer co-occur in every
+ *  episode that taught the pair, so their halos SHOULD be similar, and on a
+ *  conversational store they are (measured on the CONV fixture: consecutive
+ *  turns at 0.809 against a 0.516 concept threshold).  A gate reading halo
+ *  cosine alone therefore reads adjacency as synonymy and revoices an answer
+ *  in the words of the question it answers — "it hangs in madrid" spliced back
+ *  into "where is it kept now".  The distributional layer cannot tell the two
+ *  relations apart, because to it they are the same observation; the exact
+ *  half can, for free, because it stored the edge.  §4.1's division of labour
+ *  exactly: approximate proposes, exact decides.
+ *
+ *  Read LIMITed in both directions at the hub bound — a common continuation's
+ *  fan-in is corpus-sized, and no single decision may scale with it. */
+export function answers(
+  ctx: MindContext,
+  a: number,
+  b: number,
+): boolean {
+  const bound = hubBound(ctx);
+  if (ctx.store.hasNext(a) && ctx.store.nextFirst(a, bound).includes(b)) {
+    return true;
+  }
+  return ctx.store.hasNext(b) && ctx.store.nextFirst(b, bound).includes(a);
+}
+
 // ── Edge disambiguation (Section 6) ──────────────────────────────────────
 
 /** The best-scoring item by cosine against `query`, among items scoring at

package/src/store-sqlite.ts

@@ -146,6 +146,20 @@ CREATE TABLE IF NOT EXISTS canon (
   id INTEGER NOT NULL,
   PRIMARY KEY (h, id)
 ) WITHOUT ROWID;
+-- CONSTITUENT SKETCH (Store.sketchGet/sketchPut): the bottom-k minimal
+-- constituents of a node's subtree, k = √D, chosen by identity hash.  The blob is
+-- a packed int32 little-endian run, already in hash order; an EMPTY blob is a
+-- real answer (a minimal unit has no constituents) and a MISSING ROW means
+-- "not yet computed" — the two must stay distinguishable, which is why absence
+-- is a missing row rather than an empty blob sentinel.  (node:sqlite binds a
+-- zero-length Uint8Array as NULL, so the column is nullable and a NULL blob
+-- reads back as the empty sketch — the ROW is what records "computed".)
+-- Measured on the trained
+-- store: 80.8% of nodes sketch EMPTY, mean 1.14 ids, ~72 MB over 15.7M nodes.
+CREATE TABLE IF NOT EXISTS sketch (
+  id  INTEGER PRIMARY KEY,
+  ids BLOB
+);
 CREATE TABLE IF NOT EXISTS snapshot (
   id INTEGER PRIMARY KEY CHECK (id = 1),
   data BLOB NOT NULL
@@ -256,6 +270,8 @@ export class SQliteStore extends AbstractStore implements Store {
   private _insCanon: any = null;
   private _selCanon: any = null;
   private _cntCanon: any = null;
+  private _insSketch: any = null;
+  private _selSketch: any = null;
   private _selContentFrom: any = null;
   private _delMeta: any = null;
   private _insSnapshot: any = null;
@@ -1029,6 +1045,43 @@ export class SQliteStore extends AbstractStore implements Store {
     return (this._selCanon.all(h) as Array<{ id: number }>).map((r) => r.id);
   }
 
+  // -- Constituent sketch (Store optional capability) --
+
+  sketchGet(id: number): number[] | null {
+    if (!this._selSketch) {
+      this._selSketch = this.sqlite!.prepare(
+        "SELECT ids FROM sketch WHERE id = ?",
+      );
+    }
+    const row = this._selSketch.get(id) as
+      | { ids: Uint8Array | null }
+      | undefined;
+    if (row === undefined) return null; // never computed — NOT the same as []
+    const b = row.ids;
+    if (b === null || b.byteLength === 0) return []; // computed, no constituents
+    const out: number[] = [];
+    const dv = new DataView(b.buffer, b.byteOffset, b.byteLength);
+    for (let i = 0; i + 4 <= b.byteLength; i += 4) {
+      out.push(dv.getInt32(i, true));
+    }
+    return out;
+  }
+
+  sketchPut(id: number, ids: readonly number[]): void {
+    if (!this._insSketch) {
+      this._insSketch = this.sqlite!.prepare(
+        "INSERT OR REPLACE INTO sketch (id, ids) VALUES (?, ?)",
+      );
+    }
+    const b = new Uint8Array(ids.length * 4);
+    const dv = new DataView(b.buffer);
+    for (let i = 0; i < ids.length; i++) dv.setInt32(i * 4, ids[i], true);
+    // Join the deferred write transaction (committed by flush/commit), like
+    // canonAdd — a training run writes these in bulk.
+    this._dbBeginTx();
+    this._insSketch.run(id, b);
+  }
+
   canonCount(): number {
     if (!this._cntCanon) {
       this._cntCanon = this.sqlite!.prepare(

package/src/store.ts

@@ -524,6 +524,34 @@ export interface Store {
     fromId?: NodeId,
   ): void;
 
+  // ── constituent sketch (optional capability) ───────────────────────────
+  // The bottom-k MINIMAL CONSTITUENTS of a node's subtree, k derived from the
+  // representation's own capacity (√D — see companyProfile in mind/learning.ts),
+  // selected by identity hash so the choice is a property of each constituent
+  // and never of where it sits in the fold.
+  //
+  // DURABLE DERIVED STATE, NOT A CACHE.  §2.12 permits a cache to cost only
+  // speed; this decides which terms enter a halo — a learned relation — so an
+  // eviction would change the geometry rather than slow it down.  It is
+  // therefore written like the canon index: computed once, kept, never
+  // budgeted.  Soundness rests on the set being INTRINSIC — minimality,
+  // `len ≥ W` and non-domination are properties of the node's own subtree and
+  // do not move as the corpus grows.  The one corpus-dependent reading, the
+  // hub exclusion, is deliberately NOT stored: it is applied by the caller at
+  // pour time over the ≤ k candidates, which is the drift companyProfile
+  // already documents as benign and one-directional.
+  //
+  // Backends that do not implement the pair leave both absent; companyProfile
+  // then recomputes the sketch per pour and simply loses the amortisation.
+
+  /** The stored sketch of `id`, or null when it has never been computed.
+   *  An empty array is a REAL answer (a minimal unit has no constituents) and
+   *  must be distinguished from null. */
+  sketchGet?(id: NodeId): NodeId[] | null;
+  /** Record `ids` as the sketch of `id`.  Idempotent; ids are already sorted
+   *  by the caller's identity hash. */
+  sketchPut?(id: NodeId, ids: readonly NodeId[]): void;
+
   // ── lifecycle ──────────────────────────────────────────────────────────
   size(): Promise<number>;
   saveSnapshot(bytes: Uint8Array): Promise<void>;

package/test/29-counterfactual.test.mjs

@@ -521,8 +521,27 @@ test("D1 — site-aware climb finds diverse anchors for CAST weave", async () =>
   await m.store.close();
 });
 
+// D2 asserted `provenance === "cast"` — a PROXY, and it hid the very thing this
+// test is named for.  The climb here elects between two anchors whose votes sit
+// 0.54σ–1.04σ apart, i.e. inside the estimator's own resolution: `steel is hard
+// so steel is strong` scores 0.897–1.013 depending on the seed while `water is
+// frigid so water is freezing` holds ~0.983, so the TOP FLIPS on 6 of 24 seeds
+// (measured; the SD tracks 1/√D and the flip rate collapses 19/60 → 12/60 →
+// 2/60 as D goes 256 → 1024 → 4096).  CAST voiced the runner-up regardless of
+// which anchor the climb had committed, so the proxy stayed green while the
+// climb was demonstrably seed-dependent.  See `test/87-codominant-commitment`.
+//
+// The strong form asserts the property in the title: every seed must produce
+// the SAME OUTCOME — same provenance and same bytes.  Uniformity alone is not
+// enough (all seeds could agree on a wrong answer), so correctness is asserted
+// too: the property transfer must still land on "freezing" via CAST.
+//
+// The seed set deliberately includes 1, 8, 18, 20, 22 and 23 — the seeds whose
+// noise puts the OTHER anchor on top.  A seed set that never flips would not
+// exercise the defect at all.
 test("D2 — site-aware climb is seed-independent", async () => {
-  for (const seed of [1, 7, 42, 99]) {
+  const outcomes = new Map();
+  for (const seed of [1, 7, 8, 18, 20, 22, 23, 42, 99]) {
     const m = mk(seed);
     await m.ingest([
       ["ice is cold so ice is brittle", "brittle"],
@@ -530,11 +549,29 @@ test("D2 — site-aware climb is seed-independent", async () => {
       ["water is frigid so water is freezing", "freezing"],
     ]);
     const r = await m.respond("steel is frigid");
-    assert.equal(
-      r.provenance,
-      "cast",
-      `seed ${seed}: CAST must fire — got ${r.provenance}`,
-    );
+    const text = new TextDecoder().decode(r.bytes ?? new Uint8Array());
+    outcomes.set(seed, `${r.provenance}|${text}`);
     await m.store.close();
   }
+  const distinct = new Set(outcomes.values());
+  assert.equal(
+    distinct.size,
+    1,
+    `the outcome depends on the seed — ${
+      [...outcomes].map(([s, o]) => `seed ${s}: ${JSON.stringify(o)}`).join(
+        "; ",
+      )
+    }`,
+  );
+  const [only] = distinct;
+  assert.ok(
+    only.startsWith("cast|"),
+    `seed-independent, but not through CAST: ${JSON.stringify(only)}`,
+  );
+  assert.ok(
+    /freezing/i.test(only),
+    `seed-independent, but the property transfer was lost: ${
+      JSON.stringify(only)
+    }`,
+  );
 });

package/test/76-type-level-company.test.mjs

@@ -0,0 +1,342 @@
+// 76 — TYPE-LEVEL COMPANY (the halo pour's constituent profile).
+//
+// What is under test is ONE claim: two forms become distributional siblings
+// when their partners are MADE OF a shared content unit, even though the
+// partners share no node at the top of the fold.  That is the difference
+// between a halo keyed on a TOKEN ("occurred next to node #4711992") and one
+// keyed on a TYPE ("occurred next to something containing 'Paris'").
+//
+// WHY THESE TESTS CANNOT PASS BY ACCIDENT.  Every positive assertion is paired
+// with a NEGATIVE CONTROL drawn from the same fixture, trained in the same
+// store, of the same shape and comparable length — so a change that merely
+// made all halos correlate (the null model collapsing) fails the control
+// instead of passing the positive.  Every bar is DERIVED from D, never tuned:
+// `significanceBar` (3/√D) for "this is not chance" and `conceptThreshold` for
+// "these are the same concept".  And T1 computes, in-test, the fact that makes
+// the whole file a test of the constituent descent rather than of halos in
+// general: the two partners' depth-1 constituent sets are DISJOINT, so a
+// profile reading only `rec.kids` has literally nothing in common to find.
+//
+// WHAT EACH TEST IS, STATED HONESTLY.  T1 and T2 are the CAPABILITY tests:
+// run against the previous depth-1 profile they fail, on the capability
+// assertion itself and not on a precondition — measured -0.0086 against the
+// 0.0938 bar, while the fixture's own preconditions still passed, so the
+// failure is the missing capability and nothing else.  T3, T4 and T5 pass
+// under BOTH implementations by construction: they are not evidence for the
+// capability, they are the invariants it must not buy itself with, and each
+// one pins a regression this work actually hit — the null model collapsing
+// when the descent superposed scaffolding, mass tracking constituents instead
+// of episodes, and the profile being read from the deposit's id map instead
+// of the store.  Claiming all five as proof of the capability would be false;
+// dropping the three would leave the two unfalsifiable.
+//
+// WHAT IS DELIBERATELY NOT TESTED HERE, AND WHY.  A sixth test asserting that
+// company GRADES with shared content (more shared units => more company) was
+// written and removed: it is false as stated.  Cosine normalizes by profile
+// size, so a pair sharing 3 constituents out of a larger profile scores BELOW
+// a pair sharing 1 out of a smaller one — measured at 0.085 against 0.111,
+// consistently across all four seeds.  The design's own `shared / (1 + k)`
+// reading is size-RELATIVE, and asserting the absolute form encodes a law the
+// system does not obey.  Testing the relative form from outside would require
+// re-deriving the profile's term-selection rules inside the test, which makes
+// the test a mirror of the implementation and worthless as a check on it.
+//
+// Also untested, and a real limitation rather than an oversight: on a store
+// this small the hub bound √N is large enough that frame scaffolding is not
+// excluded, so short partners sharing only a frame do keep some company.  That
+// is the documented honest floor — a corpus that cannot yet say what
+// discriminates — but it means these fixtures must share genuine CONTENT
+// units, which T1 now asserts rather than assumes.
+//
+// Each test pins a DIFFERENT rule.  Deleting any one of them lets a specific,
+// named regression back in; none of them subsumes another.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  conceptThreshold,
+  cosine,
+  Mind,
+  significanceBar,
+} from "../dist/src/index.js";
+
+const D = 1024;
+const BAR = significanceBar(D); // 3/√D — above chance
+const enc = new TextEncoder();
+
+// Company signatures key on NODE ID, not on the alphabet, so a seeded
+// keyring cannot be what makes these comparisons come out — but that is an
+// argument, and the capability tests below check it instead, across seeds.
+const SEEDS = [7, 1, 42, 99];
+const newMind = (seed = 7) => new Mind({ seed, D });
+const idOf = (m, s) => m.resolve(enc.encode(s));
+const haloOf = (m, s) => {
+  const id = idOf(m, s);
+  return id === null || id === undefined ? null : m.store.halo(id);
+};
+
+/** The halo read must work at all before any comparison means anything.  A
+ *  missing halo silently makes every cosine below unreachable, and a broken
+ *  one makes them meaningless — this is the control whose absence has voided
+ *  whole investigations on this codebase. */
+const assertHaloControl = (m, cues) => {
+  for (const c of cues) {
+    const h = haloOf(m, c);
+    assert.ok(h, `CONTROL: no halo poured for ${JSON.stringify(c)}`);
+    assert.ok(
+      Math.abs(cosine(h, h) - 1) < 1e-9,
+      `CONTROL: halo of ${JSON.stringify(c)} is not self-identical`,
+    );
+  }
+};
+
+/** The continuation a cue was trained with, as a node id. */
+const partnerOf = (m, cue) => m.store.next(idOf(m, cue))[0];
+
+/** Depth-1 constituents — what a profile reading only `rec.kids` would see. */
+const depth1 = (m, node) => new Set(m.store.get(node)?.kids ?? []);
+
+/** Every constituent reachable below `node`, to a depth the fold cannot
+ *  exceed for these fixtures — what the descent can see. */
+const deepConstituents = (m, node, depth = 6, out = new Set()) => {
+  if (depth === 0) return out;
+  for (const k of m.store.get(node)?.kids ?? []) {
+    if (k < 0) continue;
+    out.add(k);
+    deepConstituents(m, k, depth - 1, out);
+  }
+  return out;
+};
+
+const intersect = (a, b) => [...a].filter((x) => b.has(x));
+
+// ═══════════════════════════════════════════════════════════════════════════
+// T1 — THE CAPABILITY, with its own impossibility proof for the old rule.
+//
+// Two sentences in different languages that both mention Paris.  Content-
+// defined cuts put the shared unit in DIFFERENT top-level chunks:
+//   "The Eiffel Tower is in Paris"  ->  "The Eiffel " · "Tower is in Paris"
+//   "Tour Eiffel dia any Paris"     ->  "Tour Eiffel " · "dia any Paris"
+// so their depth-1 constituents are disjoint — asserted below, not assumed.
+// ═══════════════════════════════════════════════════════════════════════════
+test("T1: partners sharing a unit BELOW the top of the fold keep company", async () => {
+  for (const seed of SEEDS) {
+    const m = newMind(seed);
+    await m.ingest([
+      ["cue_en", "The Eiffel Tower is in Paris"],
+      ["cue_mg", "Tour Eiffel dia any Paris"],
+      ["cue_zz", "Bananas are grown in humid climates"],
+    ]);
+    assertHaloControl(m, ["cue_en", "cue_mg", "cue_zz"]);
+
+    const pEn = partnerOf(m, "cue_en");
+    const pMg = partnerOf(m, "cue_mg");
+
+    // THE IMPOSSIBILITY PROOF.  A profile built from `rec.kids` alone sees these
+    // sets and nothing else; they do not intersect, so no depth-1 rule — however
+    // weighted, however filtered — can make these two partners share a term.
+    // This test therefore measures the DESCENT, not halos in general.
+    assert.equal(
+      intersect(depth1(m, pEn), depth1(m, pMg)).length,
+      0,
+      "fixture no longer exercises the descent: the two partners now share a " +
+        "depth-1 constituent, so a depth-1 profile could pass T1 as well",
+    );
+    // And the units the descent is supposed to find must actually be there —
+    // AND be eligible to become profile terms.  A fixture whose only shared
+    // constituents are sub-window shards or frame scaffolding measures frame
+    // similarity while reading like a content test; one was written during this
+    // work and passed for exactly that wrong reason.  The shared unit must be
+    // at least the fold's own window wide.
+    const W = m.space.maxGroup;
+    const shared = intersect(
+      deepConstituents(m, pEn),
+      deepConstituents(m, pMg),
+    );
+    assert.ok(
+      shared.some((n) => m.store.contentLen(n, W) >= W),
+      `fixture is broken: the partners share no constituent of at least W=${W} ` +
+        `bytes, so nothing they share can enter a profile`,
+    );
+
+    const related = cosine(haloOf(m, "cue_en"), haloOf(m, "cue_mg"));
+    const control = cosine(haloOf(m, "cue_en"), haloOf(m, "cue_zz"));
+
+    assert.ok(
+      related >= BAR,
+      `seed ${seed}: partners sharing a content unit must keep measurable ` +
+        `company: got ${related.toFixed(4)}, need >= ${
+          BAR.toFixed(4)
+        } (3/sqrt(D))`,
+    );
+    // The control is what makes the line above falsifiable: without it, a
+    // regression that made EVERY halo correlate would pass.
+    assert.ok(
+      control < BAR,
+      `seed ${seed}: partners sharing nothing must stay at chance: got ` +
+        `${control.toFixed(4)}, need < ${
+          BAR.toFixed(4)
+        } — null model collapsed`,
+    );
+    await m.store.close();
+  }
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// T2 — ORDER INDEPENDENCE.
+//
+// The tempting stop rule ("descend while a constituent is corpus-unique, stop
+// at the first one attested twice") passes T1 in exactly one training order
+// and fails in the other: when the FIRST partner is poured its shared unit has
+// fan-in 1, so the descent runs past it and only the second partner ever
+// profiles it.  Whether two forms become siblings must not depend on which was
+// taught first.
+// ═══════════════════════════════════════════════════════════════════════════
+test("T2: company does not depend on which partner was taught first", async () => {
+  const measure = async (first, second, seed) => {
+    const m = newMind(seed);
+    await m.ingest([
+      [first[0], first[1]],
+      [second[0], second[1]],
+      ["cue_zz", "Bananas are grown in humid climates"],
+    ]);
+    assertHaloControl(m, ["cue_en", "cue_mg", "cue_zz"]);
+    return {
+      related: cosine(haloOf(m, "cue_en"), haloOf(m, "cue_mg")),
+      control: cosine(haloOf(m, "cue_en"), haloOf(m, "cue_zz")),
+    };
+  };
+  const EN = ["cue_en", "The Eiffel Tower is in Paris"];
+  const MG = ["cue_mg", "Tour Eiffel dia any Paris"];
+
+  for (const seed of SEEDS) {
+    const forward = await measure(EN, MG, seed);
+    const reverse = await measure(MG, EN, seed);
+
+    for (const [name, r] of [["forward", forward], ["reverse", reverse]]) {
+      assert.ok(
+        r.related >= BAR,
+        `seed ${seed} ${name} order: shared-unit company must survive ` +
+          `training order — got ${r.related.toFixed(4)}, need >= ` +
+          `${BAR.toFixed(4)}`,
+      );
+      assert.ok(
+        r.control < BAR,
+        `seed ${seed} ${name} order: control must stay at chance, got ` +
+          `${r.control.toFixed(4)}`,
+      );
+    }
+  }
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// T3 — THE NULL MODEL SURVIVES.
+//
+// The failure mode opposite to T1's: a descent that superposed everything it
+// walked past would put terms shared by every deposit into every profile, and
+// ALL halos would correlate.  That regression passes T1 handsomely.  Here a
+// population of mutually unrelated partners must stay mutually at chance —
+// and, because it is the same store, T1's positive is re-checked against this
+// population's own noise level rather than against a bar alone.
+// ═══════════════════════════════════════════════════════════════════════════
+test("T3: unrelated partners stay mutually at chance", async () => {
+  const m = newMind();
+  const FACTS = [
+    ["c1", "Volcanoes erupt when magma reaches the surface"],
+    ["c2", "The violin has four strings tuned in fifths"],
+    ["c3", "Penguins are flightless birds of the southern seas"],
+    ["c4", "Concrete gains strength for weeks after it is poured"],
+    ["c5", "The abacus was used for arithmetic in many cultures"],
+    ["c6", "Lightning heats the air it passes through"],
+  ];
+  await m.ingest(FACTS);
+  assertHaloControl(m, FACTS.map((f) => f[0]));
+
+  let worst = -1, worstPair = "";
+  for (let i = 0; i < FACTS.length; i++) {
+    for (let j = i + 1; j < FACTS.length; j++) {
+      const c = cosine(haloOf(m, FACTS[i][0]), haloOf(m, FACTS[j][0]));
+      if (c > worst) {
+        worst = c;
+        worstPair = `${FACTS[i][0]}~${FACTS[j][0]}`;
+      }
+    }
+  }
+  assert.ok(
+    worst < BAR,
+    `unrelated partners must not keep company: worst pair ${worstPair} at ` +
+      `${worst.toFixed(4)}, need < ${BAR.toFixed(4)}.  A profile that ` +
+      `superposes scaffolding makes every halo correlate.`,
+  );
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// T4 — ONE EPISODE POURS ONE UNIT OF MASS.
+//
+// The profile is normalized precisely so that enriching it cannot inflate the
+// evidence it represents: `haloMass` counts EPISODES, and every mass-based
+// reading in the system (recall's corroboration counts, the disambiguation
+// tiers) depends on that staying true.  A profile that forgot to normalize
+// would pass T1 and T3 and silently re-weight the whole distributional layer.
+// ═══════════════════════════════════════════════════════════════════════════
+test("T4: enriching the profile does not inflate halo mass", async () => {
+  const m = newMind();
+  await m.ingest([
+    // A partner with MANY constituents, and one with very few — if mass
+    // tracked constituent count instead of episodes, these would differ.
+    ["rich", "The quick brown fox jumps over the lazy dog beside the river"],
+    ["lean", "Ice melts"],
+  ]);
+  assertHaloControl(m, ["rich", "lean"]);
+
+  const massRich = m.store.haloMass(idOf(m, "rich"));
+  const massLean = m.store.haloMass(idOf(m, "lean"));
+  assert.equal(
+    massRich,
+    massLean,
+    `halo mass must count episodes, not constituents: a 59-byte partner ` +
+      `poured ${massRich} against a 9-byte partner's ${massLean}`,
+  );
+  assert.equal(massRich, 1, `one episode must pour exactly one unit of mass`);
+});
+
+// ═══════════════════════════════════════════════════════════════════════════
+// T5 — THE PROFILE IS A FUNCTION OF THE STORE, NOT OF THE DEPOSIT.
+//
+// The constituents must be read from the STORE.  Read instead from the
+// depositing tree's id map — which holds only the nodes THIS deposit newly
+// interned — and a partner met a SECOND time profiles differently from the
+// first, because its subtrees are already stored and therefore absent from the
+// map.  The exact-partner case then falls from cosine 1 to 1/sqrt(1+k) and the
+// geometry stops meaning anything.  Two cues sharing the SAME partner are the
+// direct probe: their halos must be identical, whatever else changed between
+// the two deposits.
+// ═══════════════════════════════════════════════════════════════════════════
+test("T5: the same partner profiles identically on every episode", async () => {
+  const m = newMind();
+  const PARTNER = "Paris is the capital city of France";
+  await m.ingest([
+    ["first", PARTNER],
+    // An unrelated deposit in between, so the second pour happens against a
+    // store that has grown and a tree whose subtrees are all already interned.
+    ["filler", "Sandstone forms from compressed grains"],
+    ["second", PARTNER],
+  ]);
+  assertHaloControl(m, ["first", "second"]);
+
+  const same = cosine(haloOf(m, "first"), haloOf(m, "second"));
+  assert.ok(
+    same > 1 - 1e-6,
+    `two cues sharing one partner must have identical halos: got ` +
+      `${same.toFixed(6)}.  The profile is being read from the deposit's id ` +
+      `map rather than from the store.`,
+  );
+  // Falsifiability: identical halos must not be an artefact of ALL halos in
+  // this store being identical.
+  const different = cosine(haloOf(m, "first"), haloOf(m, "filler"));
+  assert.ok(
+    different < conceptThreshold(D),
+    `control: a different partner must not yield the same halo, got ` +
+      `${different.toFixed(4)}`,
+  );
+});