@hviana/sema 0.5.9 → 0.7.1

package/src/mind/resonance.ts

@@ -12,7 +12,7 @@ import { concat2, concatBytes, indexOf } from "../bytes.js";
 import type { MindContext } from "./types.js";
 import { gistOf, read, resolve, walkTree } from "./primitives.js";
 import { perceive } from "./primitives.js";
-import { argmaxBy, argmaxCosine, candidateGist, hubBound } from "./traverse.js";
+import { argmaxCosine, candidateGist, hubBound } from "./traverse.js";
 import {
   cachedRead,
   type Junction,
@@ -365,7 +365,13 @@ export async function pivotInto(
     }
     for (const c of n.kids) queue.push(c); // breadth-first: larger regions first
   }
-  const rec = recognise(ctx, answer);
+  // TRIMMED recognition: the pivot's own filter below rejects fragments
+  // (`hasParents || hasContainers → -Infinity`), and recognition's edge-trim
+  // fallbacks exist to find exactly those misaligned FRAGMENTS.  Skipping them
+  // (the structural pass + canonResolve still run) is byte-identical for every
+  // pivot — the fallbacks' output is discarded by the filter — and halves the
+  // O(n·W²) recognition of a long answer (measured: 36KB recognise 4.0s → 2.0s).
+  const rec = recognise(ctx, answer, true);
   for (const s of rec.sites) {
     if (!consumed.has(s.payload) && ctx.store.hasNext(s.payload)) {
       scored.set(s.payload, Math.max(scored.get(s.payload) ?? 0, 1));
@@ -373,54 +379,77 @@ export async function pivotInto(
   }
   // Byte containment, longest wins — the answer literally contains the
   // pivot's bytes, and the biggest well-evidenced span is the real pivot.
-  const found = argmaxBy(
-    scored.keys(),
-    (id) => {
-      // A PIVOT MUST BE A THING THE CORPUS DEPOSITED, NOT A PIECE OF ONE.
-      // "Longest wins" ranks candidates but never asks whether the winner is
-      // an entity at all, and by the time a chain reaches here `consumeAll`
-      // has taken the answer's real contexts — so on a corpus of
-      // near-identical records the field is left to whatever interned
-      // fragments remain.  Measured on a 200-line templated log corpus, query
-      // "what happened to request_id=1042 and request_id=1077?": CAST
-      // produced the correct comparison and one `pivotStep` replaced it
-      // wholesale, pivoting through `s=70` — a four-byte tail of
-      // `latency_ms=70` — onto an unrelated record (`handled 1130`).
-      //
-      // The separator is NOT length.  Measured against the multi-hop tests'
-      // own pivots: `Paris` (5 bytes), `Jupiter` (7), `lithium` (7), `Mona
-      // Lisa` (9) against junk `s=70` (4) — a two-quantum floor, which
-      // confluence.ts applies to a meet for the same "one window is not an
-      // entity" reason, discards three of the four legitimate pivots.
-      // Entities are simply short.
-      //
-      // What separates them is STRUCTURAL, and the store already holds it:
-      //
-      //   s=70       parents 2  containers 1  prevCount 0  halo no
-      //   Paris      parents 0  containers 0  prevCount 1  halo yes
-      //   Jupiter    parents 0  containers 0  prevCount 1  halo yes
-      //   lithium    parents 0  containers 0  prevCount 1  halo yes
-      //   Mona Lisa  parents 0  containers 0  prevCount 1  halo yes
-      //
-      // A deposited whole — a context or an answer — is interned in its own
-      // right and has neither structural parents nor containment links.  A
-      // fragment is addressable ONLY because window interning made its span
-      // addressable inside something bigger, and that containment is exactly
-      // what `parents`/`containers` record.  Reasoning steps THROUGH a fact;
-      // a span that was never a fact on its own is not one to step through.
-      // No constant enters — it is a structural predicate, not a threshold.
-      if (ctx.store.hasParents(id) || ctx.store.hasContainers(id)) {
-        return -Infinity;
-      }
-      const bytes = read(ctx, id);
-      if (indexOf(answer, bytes, 0) < 0) return -Infinity;
-      for (const v of voiced) if (indexOf(v, bytes, 0) >= 0) return -Infinity;
-      return bytes.length;
-    },
-    0,
-    true,
-  );
-  return found?.item ?? null;
+  //
+  // REAL SATURATION, not a hard cap: the score IS the candidate's byte
+  // length, so the scan is DECIDED the moment the first candidate that passes
+  // every filter is found in DESCENDING length order — a shorter candidate can
+  // never outscore it.  `contentLen` (the prefix-capped length read, §2.8) is
+  // the cheap ordering key, and the first-inserted tie-break is made explicit
+  // (`a.index - b.index`) so equal lengths keep `scored`'s insertion order —
+  // exactly the tie argmaxBy(strict) used to keep.  The bytes of at most ONE
+  // winning candidate are read; every shorter candidate the probes proposed is
+  // skipped without reconstruction, where the old argmax read them all.
+  const ranked = [...scored.keys()]
+    .map((id, index) => ({
+      id,
+      index,
+      len: ctx.store.contentLen(id, answer.length + 1),
+    }))
+    .sort((a, b) => b.len - a.len || a.index - b.index);
+  let pivotId: number | null = null;
+  for (const c of ranked) {
+    const id = c.id;
+    // A PIVOT MUST BE A THING THE CORPUS DEPOSITED, NOT A PIECE OF ONE.
+    // "Longest wins" ranks candidates but never asks whether the winner is
+    // an entity at all, and by the time a chain reaches here `consumeAll`
+    // has taken the answer's real contexts — so on a corpus of
+    // near-identical records the field is left to whatever interned
+    // fragments remain.  Measured on a 200-line templated log corpus, query
+    // "what happened to request_id=1042 and request_id=1077?": CAST
+    // produced the correct comparison and one `pivotStep` replaced it
+    // wholesale, pivoting through `s=70` — a four-byte tail of
+    // `latency_ms=70` — onto an unrelated record (`handled 1130`).
+    //
+    // The separator is NOT length.  Measured against the multi-hop tests'
+    // own pivots: `Paris` (5 bytes), `Jupiter` (7), `lithium` (7), `Mona
+    // Lisa` (9) against junk `s=70` (4) — a two-quantum floor, which
+    // confluence.ts applies to a meet for the same "one window is not an
+    // entity" reason, discards three of the four legitimate pivots.
+    // Entities are simply short.
+    //
+    // What separates them is STRUCTURAL, and the store already holds it:
+    //
+    //   s=70       parents 2  containers 1  prevCount 0  halo no
+    //   Paris      parents 0  containers 0  prevCount 1  halo yes
+    //   Jupiter    parents 0  containers 0  prevCount 1  halo yes
+    //   lithium    parents 0  containers 0  prevCount 1  halo yes
+    //   Mona Lisa  parents 0  containers 0  prevCount 1  halo yes
+    //
+    // A deposited whole — a context or an answer — is interned in its own
+    // right and has neither structural parents nor containment links.  A
+    // fragment is addressable ONLY because window interning made its span
+    // addressable inside something bigger, and that containment is exactly
+    // what `parents`/`containers` record.  Reasoning steps THROUGH a fact;
+    // a span that was never a fact on its own is not one to step through.
+    // No constant enters — it is a structural predicate, not a threshold.
+    if (ctx.store.hasParents(id) || ctx.store.hasContainers(id)) continue;
+    // A candidate whose bytes are LONGER than the answer cannot be a
+    // substring of it — `indexOf` would return −1 regardless.  Prune by
+    // length BEFORE reconstructing the bytes: `read` is an UNCAPPED read
+    // (AGENTS §2.8), and a resonated context far longer than the answer is
+    // exactly the candidate that makes it cost a whole deposit's worth of
+    // reconstruction for a containment test that must fail.  `contentLen`
+    // with the `answer.length + 1` cap is the prefix-capped length read the
+    // same contract prescribes; the prune is byte-identical to the old
+    // `indexOf` miss (it returns −1 for a needle longer than the haystack).
+    if (c.len > answer.length) continue;
+    const bytes = read(ctx, id);
+    if (indexOf(answer, bytes, 0) < 0) continue;
+    if (voiced.some((v) => indexOf(v, bytes, 0) >= 0)) continue;
+    pivotId = id;
+    break;
+  }
+  return pivotId;
 }
 
 /** Which of the given labelled forms a span MEANS — generic resonance over

package/src/store.ts

@@ -1269,7 +1269,27 @@ export abstract class AbstractStore implements Store {
       parts.push(child);
       got += child.length;
     }
-    return concat(parts);
+    const out = concat(parts);
+    // Cache the BRANCH too, not just the leaf above.  Reconstruction is a pure
+    // function of the store, so this is a transparent cache in the strict sense
+    // — an eviction costs a re-walk and nothing else — which is exactly what
+    // `_bytesCache`'s "smallest"/"clock" configuration is for.
+    //
+    // Caching only leaves made every branch re-walk its whole subtree on every
+    // request, and the DAG is hash-consed, so the same children recur under many
+    // parents.  Measured on the 18.9M-node store, ONE 1,314-byte query:
+    // 20,021,474 `_prefix` calls over 469,083 distinct ids (42.7x reuse) to
+    // produce 87,789 results — 97.7% of the work re-derived bytes it had already
+    // built.  One single-byte leaf was reconstructed 2,599,984 times.  Measuring
+    // reuse at the TOP level only shows 1.1x and hides all of it.
+    //
+    // Only a COMPLETE reconstruction may be cached: `_prefix` is also called
+    // with a cap, and a truncated prefix stored under `id` would be served as
+    // if it were the node's whole content by the `_bytesCache` hit above.
+    // `got < maxLen` is that proof — the walk ran out of children before it ran
+    // out of budget, so nothing below was truncated either.
+    if (got < maxLen) this._bytesCache.set(id, out);
+    return out;
   }
 
   contentLen(id: NodeId, cap = Infinity): number {

package/test/13-conversation.test.mjs

@@ -20,7 +20,7 @@
 // inspects content to find turn boundaries.
 //
 // "NO SEPARATOR IS NEEDED" ≠ "A SEPARATOR IS A PROBLEM".  This file joins its
-// turns with nothing; example/train_base.ts joins its oasst2 turns with "\n".
+// turns with nothing; example/train_base joins its oasst2 turns with "\n".
 // Both are correct, and neither is a convention the other has to match: a
 // separator is CORPUS CONTENT, folded like any other byte, while a turn
 // boundary is an OFFSET the API carries beside the bytes.  A harness replaying

package/test/84-composed-answer-honesty.test.mjs

@@ -31,7 +31,8 @@
 // fabricate at low N, this goes red. It does NOT cover the real-text ceiling.
 //
 // TO REPRODUCE THE REAL FAILURE: build the same chain, then ingest ~6,000
-// deposits produced by the Taskmaster adapter (example/train_base.ts §6e′) from
+// deposits produced by the Taskmaster adapter (example/train_base/corpora/
+// taskmaster.ts) from
 // TM-2/TM-3/TM-4, and ask the two-hop question. See FINDINGS.md §A1/§A4.
 
 import { test } from "node:test";

package/test/88-dependency-footprint.test.mjs

@@ -0,0 +1,99 @@
+// 88 — the dependency footprint is a PRODUCT PROPERTY, so it is tested.
+//
+// AGENTS.md §6: "do not add runtime dependencies casually — the near-zero-
+// dependency footprint is a product feature." A feature stated only in prose
+// erodes; this suite pins it at the two places it can actually break.
+//
+//   1. The BUILT LIBRARY imports nothing outside `node:`. Not the source — the
+//      built output, because that is what a consumer loads.
+//   2. The PACKAGE declares no runtime `dependencies`. A package can be
+//      import-clean and still force installs on every consumer; that is exactly
+//      how `hyparquet` — used only by example/train_base, never by src/ — came
+//      to be installed by everyone who depended on Sema.
+//
+// The trainer example is deliberately NOT covered: it may use whatever it
+// needs, as a dev dependency, loaded lazily (see example/train_base/readers.ts).
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+const ROOT = new URL("..", import.meta.url).pathname;
+
+/** Every built .js file of the library itself. */
+function libFiles(dir = join(ROOT, "dist/src"), out = []) {
+  for (const name of readdirSync(dir)) {
+    const p = join(dir, name);
+    if (statSync(p).isDirectory()) libFiles(p, out);
+    else if (name.endsWith(".js")) out.push(p);
+  }
+  return out;
+}
+
+/** Module specifiers of static imports/exports and dynamic import() calls. */
+function specifiersOf(src) {
+  const out = [];
+  const patterns = [
+    /(?:^|\s)(?:import|export)\s[^;]*?from\s*["']([^"']+)["']/g,
+    /(?:^|\s)import\s*["']([^"']+)["']/g,
+    /\bimport\s*\(\s*["']([^"']+)["']\s*\)/g,
+    /\brequire\s*\(\s*["']([^"']+)["']\s*\)/g,
+  ];
+  for (const re of patterns) {
+    for (const m of src.matchAll(re)) out.push(m[1]);
+  }
+  return out;
+}
+
+test("the built library imports nothing outside node: builtins", () => {
+  const files = libFiles();
+  assert.ok(files.length > 0, "dist/src is empty — run `npm run build` first");
+
+  const foreign = [];
+  for (const file of files) {
+    for (const spec of specifiersOf(readFileSync(file, "utf8"))) {
+      const ok = spec.startsWith("./") || spec.startsWith("../") ||
+        spec.startsWith("node:");
+      if (!ok) foreign.push(`${file.slice(ROOT.length)} → ${spec}`);
+    }
+  }
+  assert.deepEqual(
+    foreign,
+    [],
+    "the library gained a third-party import; keep it in an example instead",
+  );
+});
+
+test("the package forces no runtime dependencies on consumers", () => {
+  const pkg = JSON.parse(
+    readFileSync(join(ROOT, "package.json"), "utf8"),
+  );
+  const deps = Object.keys(pkg.dependencies ?? {});
+  assert.deepEqual(
+    deps,
+    [],
+    "a package a consumer installs must not carry dependencies only an " +
+      "example needs — declare them under devDependencies",
+  );
+});
+
+test("the published entry points resolve inside dist/src", () => {
+  // A `main`/`exports` that reached outside dist/src would drag the example —
+  // and its dev dependencies — into a consumer's module graph.
+  const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));
+  const entries = [
+    pkg.main,
+    pkg.types,
+    pkg.exports?.["."]?.default,
+    pkg.exports?.["."]?.types,
+  ].filter(Boolean);
+  assert.ok(entries.length > 0, "no entry points declared");
+  for (const e of entries) {
+    assert.match(
+      e,
+      /^(\.\/)?dist\/src\//,
+      `entry point "${e}" escapes dist/src`,
+    );
+  }
+});

package/test/89-completion-recursion.test.mjs

@@ -0,0 +1,230 @@
+// 89-completion-recursion.test.mjs — the completion recursion must be
+// OUTPUT-SENSITIVE.
+//
+// AGENTS §2.8: "No per-query read may grow with the corpus."  §2.8 enforces
+// that per READ (nextFirst, bytesPrefix, …), and every one of those caps holds.
+// What no guard covered is the NUMBER of reads: `recompleteNode`
+// (src/mind/graph-search.ts) re-covers a produced node by calling `solve`
+// recursively, and each nested solve builds its own agenda and chart.  Its own
+// doc states the intent —
+//
+//     "its cost tracks the ANSWER's own structure, not how densely the corpus
+//      interconnects the nodes passed through"
+//
+// — but argues termination from "Distinct node ids are finite and each finished
+// completion is memoised".  Finite-in-the-corpus is exactly the bound §2.8
+// forbids, and the recursion is emitted at `cost: 0` while the nested cover's
+// own `cost` is computed and discarded, so A* has no gradient against depth.
+//
+// MEASURED on a trained store (18,938,834 nodes, edgeSourceCount 796,528):
+// `respond("Hi")` reached recursion depth 331 and 9.1 GB RSS in 56 s without
+// terminating.  Every level was a "Hi…" opener — a 2-byte hub re-entering
+// itself — and the descent visited whole utterances unrelated to the answer
+// ("Who's their goalkeeper?", "Glad I could assist, have a great day.").  That
+// is what killed a 5 h training run at a checkpoint recall: the 15 s
+// withTimeout around it is a setTimeout, and a synchronous search never yields
+// to the timer phase, so it cannot fire.
+//
+// WHY THE EXISTING GUARD MISSES IT.  14-scaling.test.mjs asserts this same law
+// ("inference: cost is sublinear in corpus size"), but builds each size point
+// from a DISJOINT salted corpus and queries it with `unknownInput()`, whose
+// "tokens are substrings of no learned form".  A query that recognises nothing
+// never enters the graph, so it never reaches the fixpoint that gates the
+// recursion.  Both assumptions are load-bearing; this file drops them.
+//
+// THE CORPUS.  Real English fragments taken from the repo's own *.md prose and
+// recombined, plus the query deposited as a standalone context with several
+// continuations (what makes a greeting a hub in real dialogue).  Eight
+// hand-written generators failed to reproduce this — chains stop after two
+// rungs, dense graphs never reach a fixpoint, and a query the pipeline declines
+// never reaches `cover` at all.  Real prose plus a deposited hub does it.
+// Nothing is added to the tree: the corpus is the documentation already here.
+//
+// MEASURED HERE, on the deterministic public counters (mind.lastCost), answer
+// byte-identical at every size:
+//
+//        pairs   searches      pops     maxDepth
+//         1508        126    55,208           71
+//         2008        196    88,241          127
+//         3008        309   146,282          207
+//         4008        416   201,174          270      (22 s for a 3-byte query)
+//
+//   growth exponent k ≈ 1.25 (searches), 1.32 (pops) — SUPER-linear.
+//
+// With the recursion bounded, the same corpus gives searches 10→13 and pops
+// 3,946→5,826 (k ≈ 0.27 / 0.40) in 0.31 s→0.76 s, and the answer does not
+// change.  So this file's thresholds are achievable, and the fix costs nothing
+// in output on this corpus.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Mind } from "../dist/src/index.js";
+import { SQliteStore } from "../dist/src/store-sqlite.js";
+
+const REPO = join(dirname(fileURLToPath(import.meta.url)), "..");
+
+// ── corpus ────────────────────────────────────────────────────────────────
+// Deterministic scrambler: the suite forbids Math.random in fixtures, and the
+// whole point of the counters is that two runs are diffable.
+const mix = (x) => {
+  x = (x ^ 61) ^ (x >>> 16);
+  x = x + (x << 3);
+  x = x ^ (x >>> 4);
+  x = Math.imul(x, 0x27d4eb2d);
+  return (x ^ (x >>> 15)) >>> 0;
+};
+
+/** Four-word windows of the repo's own English prose.  Code fences, inline
+ *  code and link targets are stripped so what is left is language, which is
+ *  where the fragment overlap lives. */
+function fragments() {
+  const out = [];
+  for (const f of readdirSync(REPO).filter((f) => f.endsWith(".md")).sort()) {
+    let t = readFileSync(join(REPO, f), "utf8");
+    t = t.replace(/```[\s\S]*?```/g, " ").replace(/`[^`]*`/g, " ");
+    t = t.replace(/\[[^\]]*\]\([^)]*\)/g, " ");
+    t = t.toLowerCase().replace(/[^a-z ]+/g, " ").replace(/\s+/g, " ");
+    const w = t.split(" ").filter(Boolean);
+    for (let i = 0; i + 4 < w.length; i += 2) {
+      out.push(w.slice(i, i + 4).join(" "));
+    }
+  }
+  return out;
+}
+
+const FRAG = fragments();
+const QUERY = "hi.";
+
+const utter = (i) =>
+  [
+    FRAG[mix(i * 3 + 1) % FRAG.length],
+    FRAG[mix(i * 5 + 2) % FRAG.length],
+    FRAG[mix(i * 7 + 3) % FRAG.length],
+  ].join(" ");
+
+/** n recombined utterance pairs, plus the query as a standalone context with
+ *  eight distinct continuations — the hub.  Every pair's answer is itself a
+ *  context (multi-turn), so a completed form has somewhere to continue. */
+function corpus(n) {
+  const pairs = [];
+  for (let k = 0; k < 8; k++) pairs.push([QUERY, utter(k * 101 + 7)]);
+  for (let i = 0; i < n; i++) {
+    pairs.push([utter(i), utter(i * 3 + 1)]);
+    pairs.push([utter(i * 3 + 1), utter(i * 7 + 2)]);
+  }
+  return pairs;
+}
+
+/** Power-law exponent k in work ≈ c·n^k, by log–log least squares — the same
+ *  statistic and the same k < 0.6 bar 14-scaling.test.mjs uses. */
+function logLogSlope(sizes, ys) {
+  const n = sizes.length;
+  const xs = sizes.map(Math.log), ly = ys.map((v) => Math.log(Math.max(v, 1)));
+  const mx = xs.reduce((a, b) => a + b, 0) / n;
+  const my = ly.reduce((a, b) => a + b, 0) / n;
+  let num = 0, den = 0;
+  for (let i = 0; i < n; i++) {
+    num += (xs[i] - mx) * (ly[i] - my);
+    den += (xs[i] - mx) ** 2;
+  }
+  return num / den;
+}
+
+// `corpus(n)` emits two pairs per turn plus the eight hub pairs, so these are
+// the 1508 / 2008 / 3008-pair points of the table above.
+const SIZES = [750, 1000, 1500];
+
+test("completion recursion: per-query work does not grow with the corpus", async () => {
+  assert.ok(
+    FRAG.length > 4000,
+    `only ${FRAG.length} prose fragments found in ${REPO}/*.md — this test ` +
+      `draws its corpus from the repo's own documentation; with the prose gone ` +
+      `it can no longer exercise the completion recursion at all`,
+  );
+
+  const searches = [], pops = [], answers = [], secs = [];
+
+  for (const n of SIZES) {
+    const store = new SQliteStore({ path: ":memory:", D: 1024 });
+    const mind = new Mind({ seed: 7, store, profile: true });
+    await mind.ingest(corpus(n));
+
+    const t0 = performance.now();
+    const answer = String(await mind.respondText(QUERY));
+    secs.push((performance.now() - t0) / 1000);
+
+    const c = mind.lastCost.counters;
+    searches.push(c.searches ?? 0);
+    pops.push(c.searchPops ?? 0);
+    answers.push(answer);
+    await store.close();
+  }
+
+  console.log("    completion recursion vs corpus size (fixed 3-byte query):");
+  SIZES.forEach((n, i) =>
+    console.log(
+      `      pairs=${String(n * 2 + 8).padStart(5)}  searches=${
+        String(searches[i]).padStart(5)
+      }  pops=${String(pops[i]).padStart(8)}  ${secs[i].toFixed(2)}s`,
+    )
+  );
+
+  // NON-VACUITY.  If the corpus stopped reaching the recursion, every counter
+  // would be flat at zero and the growth assertions below would pass while
+  // proving nothing.  A test that can go green by not exercising the code is
+  // worse than no test, so this fails loudly instead.
+  assert.ok(
+    searches.every((s) => s > 0),
+    `the graph search never ran (searches=${JSON.stringify(searches)}) — the ` +
+      `corpus no longer engages cover(), so this file is not testing anything`,
+  );
+
+  // NO OUTPUT CONFOUND.  Work is allowed to grow with the ANSWER.  Pinning the
+  // answer byte-for-byte across every size removes that defence entirely: any
+  // growth measured below bought exactly nothing.
+  assert.ok(
+    answers.every((a) => a === answers[0]),
+    `the answer changed across corpus sizes (${
+      JSON.stringify(answers.map((a) => a.slice(0, 40)))
+    }) — with the output moving, work growth is no longer attributable to the ` +
+      `corpus alone`,
+  );
+
+  const kSearches = logLogSlope(SIZES, searches);
+  const kPops = logLogSlope(SIZES, pops);
+  console.log(
+    `      growth exponent k ≈ ${kSearches.toFixed(2)} (nested searches), ${
+      kPops.toFixed(2)
+    } (agenda pops) — target ≪ 1 (sublinear in the corpus)`,
+  );
+
+  // THE LAW.  Same answer, more corpus, so cost must not move.  k ≈ 0 is flat,
+  // k ≈ 1 is linear in the corpus — the bound §2.8 forbids outright.
+  //
+  // `searches` counts nested solve() calls, which is the recursion itself and
+  // nothing else, so it gets 14-scaling.test.mjs's stricter 0.6 bar.  Measured
+  // 1.28 unfixed, 0.38 fixed.
+  assert.ok(
+    kSearches < 0.6,
+    `nested searches grew with exponent k=${kSearches.toFixed(2)} in corpus ` +
+      `size (${searches.join(" → ")}) for a byte-identical answer — each ` +
+      `nested solve() builds its own agenda and chart, so this is the ` +
+      `completion recursion doing work the answer never asked for`,
+  );
+  // A LOOSER BAR, FOR A REASON.  `searchPops` aggregates the TOP-LEVEL cover's
+  // agenda too, and that one legitimately carries some corpus sensitivity: a
+  // bigger store recognises more sites inside the same query, so more items are
+  // admissible.  Only outright linear growth is the forbidden case (§2.8), so
+  // this asserts the law itself, k < 1, rather than the stricter 0.6 that suits
+  // a counter the fix governs end to end.  Measured 1.40 unfixed, 0.54 fixed.
+  assert.ok(
+    kPops < 1,
+    `agenda pops grew with exponent k=${kPops.toFixed(2)} in corpus size (${
+      pops.join(" → ")
+    }) for a byte-identical answer — k≈1 is work LINEAR in the corpus, which ` +
+      `is the bound §2.8 forbids outright`,
+  );
+});