@hviana/sema 0.9.3 → 0.9.5

package/docs/architecture/saturation.md

@@ -1,104 +1,78 @@
-# Saturation — Named Stop, Not Cap
-
-> **Law:** every walk names a deciding saturation beside its cap. The cap is a
-> safety net; saturation is the derived stop that decides and terminates.
-
-A walk with only a cap drifts to the cap. A walk with a saturation stops the
-moment the answer (saturated vs. decided) is known — bounded, exact below the
-bound, and named in the trace.
-
-## Cap vs. saturation
-
-| Role       | Value                                                        | Nature                                           |
-| ---------- | ------------------------------------------------------------ | ------------------------------------------------ |
-| Cap        | `hubBound = ceil(sqrt(N))` per read; `hubBound * W` per walk | Safety net — prevents corpus-proportional work   |
-| Saturation | Named derived stop (`SaturationReason`)                      | Decision — proves continuing cannot discriminate |
-
-`N = corpusN = max(2, edgeSourceCount())`, `W = maxGroup`. Defined once in
-`mind/traverse.ts` (`corpusN`, `hubBound`, `boundFor`); never spelled inline.
-
-## edgeAncestors — EXPAND-UNTIL-DECIDED
-
-`mind/traverse.ts:edgeAncestors` is the model: it climbs the structural DAG
-(parents + containment) until one of five saturations decides, and is exact
-below every one of them.
-
-1. **Predecessor fan-in** — `prevCount(node) > bound` via `store.prevCount`. One
-   indexed count; no read. Proves `> bound` distinct contexts on its own.
-2. **Distinct-context limit** — `ctxSeen.size > bound` after
-   `prevFirst(node, bound)`. The accumulated set of distinct contexts reachable
-   from roots visited so far exceeds `sqrt(N)`.
-3. **Parent fan-out** — `parentsFirst(node, bound+1).length > bound`. One
-   `LIMIT bound+1` read distinguishes "exactly bound parents" from "hub". The
-   node itself is not expanded; saturated reaches are never voted.
-4. **Lateral-cone cumulative** — `lateral > bound`, where `lateral` sums
-   `fresh-1` over every expanded node's extra parents beyond its first. The
-   per-node guard catches concentration at one node; this catches the same
-   commonness distributed across the cone. A deep chain in one structure accrues
-   zero laterals and still reaches its root at any depth.
-5. **Byte-atom commonality** — `atomIsHub(N,W)` when
-   `atomReach(N,W) = max(1, ceil(N*W/256)) > bound`. Atoms carry no kid/contain
-   rows, so containment is unmeasurable; the uniform-expectation floor replaces
-   it. Above the scale the atom abstains as voter (edges remain traversable for
-   tier-0 recall).
-
-Below every threshold the walk is exact — `prevFirst(bound)` is the full list,
-`parentsFirst(bound+1)` is the full list, `containersSlice` pages are walked in
-full — identical to the unbounded climb. Work is `O(bound)` contexts times local
-structure, never `O(N)`. Container seeding is streamed in `bound`-sized pages
-for the same reason.
-
-Refuted tightening: **container fan-out as a hub** — deciding a containment seed
-saturated when its first `containersSlice(bound+1)` page overflows, the reading
-`junction.ts` applies to the same links. It conflates the PLACES a window occurs
-with the CONTEXTS it reaches, and saturation is defined over contexts. Proved on
-`test/49`'s fixture (N = 5, `sqrt(N)` = 3): `fran` sits in 4 containers yet its
-full climb reaches 2 contexts — discriminative — and the rule called it
-saturated, as it did `of f`, `fra`, `is`, `ranc`, `ance`. On the 31.7M-node
-store no such window climbed unsaturated (18 composition queries; those climbs
-were 38% of all visits), because at `sqrt(N)` = 1,560 a full page of containers
-rarely converges on few contexts — but the rule is the same wrong reading at
-both scales. The streamed seed stays.
-
-Trace records the first deciding stop as
-`SaturationStop { reason, node, observed, limit }` plus `visited`/`maxDepth`;
-absent when unsaturated or untraced.
-
-## pivotInto — longest-wins
-
-`mind/resonance.ts:pivotInto` ranks candidates by `contentLen(id, answerLen+1)`
-descending (first-inserted tie-break). The byte score is length itself, so the
-scan is decided at the first candidate that passes every filter — a shorter
-candidate can never outscore it. At most one winner's bytes are reconstructed;
-every shorter proposal is skipped without a read. Saturation, not cap.
-
-## Junction — hub guards vs. budget
-
-`mind/junction.ts:junctionContainersFrom` has three disciplines:
-
-- **Phrase-scale reads** — `bytesPrefix(maxContainer+1)` per visit; a node
-  beyond the cap prunes its branch.
-- **Per-node hub guards** (real saturations) — `parentsFirst(bound+1) > bound`
-  not expanded; one `containersSlice(bound+1)` page beyond `bound` not expanded.
-  Each is exact below `bound`.
-- **Expansion budget** — at most `bound * W` pops total (shared across a tier's
-  walks). Budget exhaustion is an abstention (`junctionBudgetExhausted`) that
-  falls through to the resonance tier — a net, not a saturation.
-
-Refuted tightening: applying `edgeAncestors`' cumulative lateral-cone limit here
-would discard half the successful junctions (measured lateral 1425/1426 at
-`bound` ~ 570).
-
-Refuted early-stop: **one-cone-exhausted** — stopping when one side's upward
-cone empties — is wrong in both hub-guarded and hub-flagged forms. A junction
-can be reachable from only one side when that side's seed is a fold sub-node of
-the container (`test/16`: "cold or hot" reached from window "cold" while 3-byte
-"hot" cone is empty; `test/34` n-ary binding fails the same way). Exhausting one
-cone never proves no junction remains; the walk must keep the `bound*W` net
-after per-node saturations.
+# Saturation — A Named Stop, Not a Cap
+
+> **Law:** every walk names the saturation that decides when it stops, beside
+> its cap. The cap (`bounded-reads.md`) is a safety net. The saturation is a
+> derived proof that continuing cannot discriminate, and it is recorded in the
+> trace.
+
+**Why.** A walk with only a cap drifts to the cap: it spends the whole budget
+and stops at an arbitrary place. A walk with a saturation stops the moment the
+outcome is known, is exact below every stop, and says why it stopped. Deflate's
+match finder truncates long chains arbitrarily. Sema may cap, but it must still
+justify every stop.
+
+The trace records the first stop that decides as
+`SaturationStop { reason, node, observed, limit }`, together with `visited` and
+`maxDepth`.
+
+## `edgeAncestors` — expand until decided (`mind/traverse.ts`)
+
+This is the model walk. It climbs parents and containers from a node to the
+learnt contexts it reaches, and stops at the first of five saturations. Each is
+exact below its threshold (`bound = √N`):
+
+1. **Predecessor fan-in.** `prevCount(node) > bound`: one indexed count proves
+   more than `bound` contexts.
+2. **Distinct contexts.** `ctxSeen.size > bound` after `prevFirst(node, bound)`.
+3. **Parent fan-out.** `parentsFirst(node, bound + 1)` returns more than
+   `bound`, and the node is not expanded.
+4. **Lateral cone.** The extra parents summed over every expanded node exceed
+   `bound`. Commonness spread across the cone is caught as surely as commonness
+   concentrated at one node, while a deep chain inside one structure accrues no
+   laterals and reaches its root at any depth.
+5. **Byte atoms.** Atoms carry no containment rows, so their reach is
+   unmeasurable, and the uniform expectation `atomReach(N, W)` replaces it. Past
+   `bound`, an atom abstains as a voter (`atomIsHub`), though its edges remain
+   traversable.
+
+Below every stop, the walk equals the unbounded climb, and its work is
+`O(bound)` contexts. Container seeds are streamed in `bound`-sized pages.
+
+**Refuted:** treating container fan-out as a hub. It confuses the _places_ a
+window occurs with the _contexts_ it reaches, and saturation is defined over
+contexts. On `test/49`, `fran` sits in 4 containers yet reaches 2 contexts, and
+the rule called it saturated.
+
+## `pivotInto` — the longest wins (`mind/resonance.ts`)
+
+Candidates rank by `contentLen(id, answerLen + 1)`, descending, with
+first-inserted breaking ties. The score is length itself, so the first candidate
+that passes every filter wins, and no shorter candidate's bytes are ever read.
+
+## Junction ascent — guards against a budget (`mind/junction.ts`)
+
+`junctionContainersFrom` keeps three disciplines apart:
+
+- **Phrase-scale reads.** `bytesPrefix(maxContainer + 1)` per visit; a node past
+  the cap prunes its branch.
+- **Hub guards, which are true saturations.** A node is not expanded when
+  `parentsFirst(bound + 1)` or one `containersSlice` page exceeds `bound`.
+- **The expansion budget, a net.** At most `bound · W` pops, shared across a
+  tier's walks. Running out is an abstention (`junctionBudgetExhausted`), and
+  the search falls through to the resonance tier.
+
+Two tightenings were refuted:
+
+- **The lateral-cone limit from `edgeAncestors`** would discard half the
+  successful junctions (lateral 1425 of 1426 at `bound` ≈ 570).
+- **Stopping when one side's cone is exhausted** is wrong. A junction can be
+  reachable from only one side when that side's seed is a fold sub-node of the
+  container. In `test/16`, `cold or hot` is reached from `cold` while the cone
+  of `hot` is empty. Exhausting one cone never proves that no junction remains.
 
 ## Pins
 
-- `test/16` — one-cone-exhausted refutation (bridge junction).
-- `test/34` — one-cone-exhausted refutation (n-ary cross-region binding).
-- `test/27` — saturation-drop gate (leading/trailing saturated intervals).
+- `test/16`, `test/34` — refute stopping when one cone is exhausted, in the
+  bridge junction and in n-ary cross-region binding.
+- `test/27` — dropping saturated leading and trailing intervals from the climb.
+- `test/49` — refutes treating container fan-out as a hub.

package/docs/architecture/store.md

@@ -1,102 +1,121 @@
-# Store — AbstractStore Owns the Domain, Adapters Own the Wires
-
-> **Law:** `AbstractStore` (`src/store.ts`) owns every domain decision — dedup,
-> near-dedup, gist/halo indexing, containment, batching, LRU, compaction.
-> `SQliteStore` (`src/store-sqlite.ts`) implements only `_db*`/`_vec*` thin
-> wrappers.
-
-## Template method
-
-```
-AbstractStore          all logic: caches, merge gates, halo schedule,
-                       buffers, chain transparency, length walks
-  └─ SQliteStore       SQL + VectorDatabase glue — one statement per method
-  └─ <NewBackend>      same contract — subclass AbstractStore only
-```
-
-A new backend subclasses `AbstractStore`; never re-implements dedup or batching.
-
-## IDs and leaves
-
-Branch ids are dense non-negative `0,1,2,…` (`_nextId`, never deleted).
-Single-byte leaves are **implicit** negative ids `-256..-1` (`-(byte+1)`), never
-a row. `has(id)` is `id < 0 || id < _nextId`.
-
-## Flat branches and bytes
-
-A branch whose kids are all leaves is **flat** — stored as raw bytes in `leaf`
-with an empty `kids` blob as marker (`flatKidsBytes`/`flatBytesKids`). Dedup
-probes hash then verify: `hashOf`→`h`→`LIMIT 1` fetch→byte compare (bloom
-negative filter first). `flatBranchMayExist(bytes)` is the filter alone — its
-`false` is exact, its `true` means "look it up" — for a caller that will verify
-anyway: `exactNode` (primitives.ts) refuses a stream whose level-0 segment
-cannot exist before naming any node, so a resolve miss costs hashing.
-`findFlatBranch` memoizes HITS (`_flatKey`, keyed by the bytes themselves) and
-never misses — the filter answers first, so a span that is not stored builds no
-key, while the segments the identity fold names, asked by every span that
-contains them, cost a map hit. `flatSpans(bytes)` returns a prober over ONE
-buffer that answers exactly `findFlatBranch(bytes.subarray(s, e))`. `hashOf` is
-FNV-1a, a left fold, so the prober extends the hash each start was last probed
-at, and keeps one byte-short copy for the edge scan's trimmed retry. A span
-scanner sweeping ends upward pays O(1) per probe instead of O(span).
-Recognition's interior pass was hashing O(n·reach²) bytes: 251,660,406 for one
-response on the 31.7M-node store (`test/153.4`).
-
-`leadsSomewhere(id)` — `hasNext || hasHalo` — is the admission predicate's ONE
-raw definition; `traverse.ts` memoises its edge tier per response.
-
-`bytes(id)`/`bytesPrefix(id, cap)` are shared with `BoundedMap` caches — callers
-must **never mutate** the returned buffer. `contentLen(id, cap)` walks with
-memo; when `cap` is given it saturates (`>= cap` without finishing) so one huge
-root never costs a full walk.
-
-## Gist, halo, dedup
-
-On `put*`, content dedup (`hashOf`→probe→mint) gates first. Short keys are
-cached (`DEDUP_KEY_MAX` bypass). Near-dedup: `identityBar(D, W, len)`, one
-window apart. Gists sit in `_pendingGist` (byte-budgeted `BoundedMap`);
-`indexSubtree` & `pourHalo` promote via `_vecContentUpsert`/`_vecHaloUpsert` in
-`batchSize` batches. Buffers flush on cadence, `commit()`, and close. Halo mass
-re-indexes geometrically (`mass<=4 || powerOfTwo`) and encodes 2-bit quantized.
-Canon index is optional: `canonAdd`/ `canonFind`/`canonCount` over 32-bit
-canonical hashes, caller verifies bytes. The SQLite backend keeps a negative
-filter over the canon hashes too (kept exact on `canonAdd`; the table is never
-deleted from), because recognition and the join probe it once per span and
-almost every answer is "no such key". It is PERSISTED (`canon_bloom`) in the
-same transaction as the canon rows it covers, stamped with that commit's
-`canon.upto`; an open whose meta disagrees with the stamp (rows written without
-it) rebuilds it by one scan of the h column — seconds on a trained store, paid
-once instead of per process (`test/36`).
-
-## Containment, batching, LRU
-
-`addContainer(child,parent)` buffers per child; flush appends via
-`_dbAppendContain` (packed pages, geometric merge) — never rewrite the whole
-list. `containersSlice` pages through it. Edges and kids write through the same
-deferred transaction.
-
-Every in-memory cache is a `BoundedMap` with byte accounting and eviction (`lru`
-vs `smallest` + `clock`/`reorder` recency). ANN reads
-(`resonate`/`resonateHalo`) are content-addressed (`vecKey`) and dropped on any
-index mutation; `RESONATE_CACHE_MAX=4096`.
-
-## Maintenance (incremental)
-
-- `compactContentIndex(minParents)` — scans only entries since last watermark
-  (`_vecContentEntriesSince`), removes indexed-but-isolated nodes (`<minParents`
-  parents, no edges/halos), compacts the vector DB.
-- `repairContentIndex(regenerateGist)` — walks `_dbEdgeOrHaloIds()` candidates
-  only, re-inserts missing bridge nodes whose gists were evicted before
-  indexing.
-- `buildCanonIndex` (`_buildCanonIndex`) — iterates `eachContent(fromId)` and
-  `canonAdd`s; `fromId` makes refresh incremental.
-
-Full scans (`parents()`, `next()`, `containers()`) are maintenance-only — hot
-paths use `LIMIT`ed probes (`parentsFirst`/`nextFirst`/`prevFirst`), `has*`,
-`prevCount`.
+# Store — A Content-Addressed DAG, One Owner of Its Logic
+
+> **Law:** a node is named by its content, and equal content is stored once.
+> `AbstractStore` (`src/store.ts`) owns every domain decision: dedup, merge,
+> indexing, containment, batching, caching and maintenance. A backend
+> (`store-sqlite.ts`) implements only thin `_db*`/`_vec*` wrappers.
+
+## Nodes
+
+| Kind        | Id                                              | Stored as                                                |
+| ----------- | ----------------------------------------------- | -------------------------------------------------------- |
+| byte leaf   | implicit, `-(byte+1)` in `−256…−1`              | nothing — it always exists                               |
+| branch      | dense `0,1,2,…`, minted in order, never deleted | its ordered child ids                                    |
+| flat branch | as a branch                                     | raw bytes, with an empty `kids` marker (`flatKidsBytes`) |
+
+An id is an arbitrary mark; content decides which mark a thing gets. A subtree
+shared by a thousand deposits is one node with a thousand parents, so storage
+grows with distinct content, not with volume, and every span the fold produced
+can be addressed.
+
+## Interning — dedup, then same bytes, then near, then mint
+
+`intern` runs four steps, in order:
+
+1. **Exact dedup.** `findLeaf` or `findBranch` looks for equal content: a cache
+   first, then a durable probe, so dedup survives a cold cache or a resumed run.
+2. **Same bytes, same node.** A branch whose children name nothing reuses the
+   flat node over the same bytes. Its gist is re-captured, because the same
+   bytes fold differently standing alone and embedded, and the index must hold
+   the gist that a direct query will present (`fold-contract.md`).
+3. **Near dedup.** This applies to branches only, and only against whole
+   experiences still in the write buffer. The gist proposes a candidate, which
+   must reach the branch's own `identityBar`. The bytes then decide: the two
+   must be identical except for one span of at most `W` bytes
+   (`differsByOneWindow`). This is the only place two different contents share
+   an id.
+4. **Mint** a new id.
+
+A refuted alternative: probing the flushed ANN index for near targets. It was
+the dominant training cost, and it was wrong. The 1-bit code ranked a
+byte-distinct branch as nearest and collapsed two different subtrees onto one id
+(`test/02`).
+
+## Relations on the nodes
+
+- **Continuation edges.** An edge is a unique `(src, dst)` pair, so
+  `prevCount(dst)` counts distinct establishing contexts, never repetitions.
+- **Containment.** `addContainer(child, parent)` buffers per child, and the
+  flush appends packed pages (`_dbAppendContain`) without rewriting the list.
+  `containersSlice` pages through it.
+- **Gist index** (content) and **halo index** (company). Both are RaBitQ-IVF ANN
+  over node ids. Gists wait in `_pendingGist` until `indexSubtree` promotes them
+  in batches. Halos accumulate exactly in session and persist 2-bit quantized
+  (`halo-sketch.md`).
+- **Sketches.** `sketchGet`/`sketchPut` hold durable derived state: a miss costs
+  time, never correctness.
+
+`leadsSomewhere(id) = hasNext || hasHalo` is the one raw admission predicate: a
+form is knowledge only if it continues somewhere or keeps company.
+
+## Probes that do not grow with N
+
+Hot paths read through `LIMIT` variants, point probes and capped byte reads, and
+full scans are for maintenance only (`bounded-reads.md`). Flat lookups are
+hashed, then verified:
+
+- `flatBranchMayExist` is a negative filter, so its `false` is exact.
+- `findFlatBranch` memoizes hits only, and a miss builds no key.
+- `flatSpans(bytes)` extends one FNV-1a hash per start position, so sweeping a
+  span's ends costs O(1) per probe instead of O(span). Recognition's interior
+  pass once hashed 251,660,406 bytes for a single response (`test/153.4`).
+
+`bytes(id)` and `bytesPrefix(id, cap)` return buffers shared with the caches.
+Callers must never mutate them.
+
+## The canonical index — optional, injected, verified
+
+`canonAdd`, `canonFind`, `canonCount` and `eachContent` are an optional backend
+capability. Without it, `resolve` has no equivalence fallback.
+
+- **The store never learns the equivalence.** The caller injects the
+  canonicalizer (`Canon`, for example `textCanon`).
+- **Every candidate is hash-then-verified:** the stored bytes are
+  re-canonicalized and compared, so a collision costs a read, never a wrong id.
+- **`buildCanonIndex` runs after training** and is incremental from a watermark.
+  A fixture store that skips it under-reports every case variant.
+- **SQLite keeps a negative filter over the canonical hashes** (`canon_bloom`).
+  It is persisted in the same transaction as the rows it covers and stamped with
+  `canon.upto`. An open whose stamp disagrees rebuilds the filter once
+  (`test/36-bloom`).
+
+## Caches and maintenance
+
+Every in-memory cache is a byte-budgeted `BoundedMap` (`caches.md`). ANN read
+caches are keyed by content (`vecKey`), dropped on any index mutation, and
+cleared at `RESONATE_CACHE_MAX`.
+
+Maintenance is incremental:
+
+- `compactContentIndex` removes isolated index entries written since its last
+  watermark.
+- `repairContentIndex` re-inserts bridge nodes whose gists were evicted before
+  they were indexed.
+- `buildCanonIndex` extends the canonical index from a given id.
 
 ## Adding a backend
 
-Implement every `protected abstract _db*`/`_vec*` in `src/store.ts` as a thin
-wrapper around your storage. Keep `_dbGet*First`/`Slice` as real `LIMIT` queries
-and `has*`/`COUNT` as point probes — never materialise-then-slice.
+1. Subclass `AbstractStore` and implement every
+   `protected abstract _db*`/`_vec*` method as a thin wrapper. Never
+   re-implement dedup or batching.
+2. Keep the `*First`/`*Slice` methods as real `LIMIT ?` queries, and keep `has*`
+   and counts as point probes. Never materialise a list and then slice it.
+3. Run the whole suite with your store substituted.
+
+## Pins
+
+- `test/08` — storage: the node layout, halo persistence and 2-bit round trip,
+  the `haloMass`/`hasHalo` contract, and survival across a reopen.
+- `test/02` — exact round trip: near dedup never merges distinct bytes.
+- `test/36-bloom` — the filters' exactness and persistence.
+- `test/153.4` — the span prober answers exactly what `findFlatBranch` answers.

package/docs/architecture/thresholds.md

@@ -1,79 +1,72 @@
-# Thresholds — derived, never tuned
-
-Every decision cutoff is a formula over `D` (vector dimension), `W` (`maxGroup`,
-perception window), or `N` (corpus size). No threshold is tuned or added to
-`src/config.ts`.
-
-## Source of truth
-
-- `src/geometry.ts` — all similarity/decision thresholds.
-- `src/mind/traverse.ts` — corpus-scale readings that parameterise bounded
-  walks.
-- `src/sema.ts` — positional coordinate algebra.
-- `src/config.ts` — capacities and budgets only (cache byte budgets, batch
-  sizes, index parameters, query `k`, ALU precision, seed). Never a threshold.
-
-## Geometry thresholds (`src/geometry.ts`)
-
-| Symbol                  | Definition                                                                   | Formula                             |
-| ----------------------- | ---------------------------------------------------------------------------- | ----------------------------------- |
-| `mergeThreshold(D)`     | Cosine below which two gists are near enough to consider merging             | `1 - 1/√D`                          |
-| `identityBar(D,W,len)`  | Scale-aware whole-span identity claim                                        | `max(mergeThreshold(D), 1 - W/len)` |
-| `reachThreshold(W)`     | Recall confidence floor — half a river quantum                               | `1 - 1/(2·W)`                       |
-| `estimatorNoise(D)`     | RaBitQ noise floor — 1σ of random cosine                                     | `1/√D`                              |
-| `significanceBar(D)`    | Whole-query relatedness — 3σ above chance                                    | `3/√D`                              |
-| `conceptThreshold(D)`   | Halo concept sharing — structural midpoint + ½σ                              | `0.5 + 0.5/√D`                      |
-| `dominates(part,whole)` | Half-dominance predicate                                                     | `part*2 > whole`                    |
-| `profileCapacity(D)`    | Superposition capacity — terms before readout collapses                      | `floor(√D)` (min 1)                 |
-| `consensusFloor(N)`     | Pooled-vote significance floor                                               | `ln(N) + ½`                         |
-| `coverageBar(_,D)`      | Reach-index gating (currently unused hot-path; batch compaction replaces it) | `conceptThreshold(D)`               |
-
-`N` in `consensusFloor` is `corpusN` (edge-source count, floored at 2).
-
-## Corpus-scale readings (`src/mind/traverse.ts`)
-
-| Symbol           | Definition                                             | Formula                     |
-| ---------------- | ------------------------------------------------------ | --------------------------- |
-| `corpusN`        | Distinct learnt contexts, floored                      | `max(2, edgeSourceCount())` |
-| `hubBound`       | Hub bound, used for every `LIMIT` read                 | `ceil(√max(2,N))`           |
-| `hubCap(ids)`    | Fan-out cap — list-side reading of `hubBound`          | `ids.slice(0, hubBound)`    |
-| `atomReach(N,W)` | Uniform-expectation floor on a byte atom's commonality | `max(1, ceil(N·W/256))`     |
-| `atomIsHub(N,W)` | Whether atom abstains as consensus voter               | `atomReach > hubBound`      |
-
-`hubBound` is enforced at the store level (`nextFirst`, `parentsFirst`,
-`containersSlice`, `hasNext`/`hasParents`, `bytesPrefix`, `chainRun`).
-`atomReach` is the honest floor for atoms — they carry no kid/contain rows, so
-their reach is unmeasurable and must not default to "maximally rare".
-
-## Seat algebra (`src/sema.ts`)
-
-`twoEndedSeat(seatCount, size, index)` — the one positional-coordinate algebra
-shared by perception, `fold`, and every synthetic/canonical fold. First half
-uses low seats, second half uses high seats:
-`index < (size+1)/2 ? index : seatCount-size+index`.
+# Thresholds — Derived, Never Tuned
+
+> **Law:** every decision cutoff is a formula over the vector dimension `D`, the
+> perception window `W` (`maxGroup`) or the corpus size `N`. `config.ts` holds
+> capacities and budgets only: cache bytes, batch sizes, index parameters, query
+> `k`, ALU precision and the seed. It never holds a threshold.
+
+**Why.** A kept memory grows, and a fixed number silently changes meaning as
+`N`, `D` or a span's length changes. A derived bar is measured against the
+medium's own chance and scale, so there is no development set to overfit and no
+calibration that expires with new data. With nothing fitted, a wrong answer
+indicts a law, never a parameter.
+
+## Three sources of scale
+
+**`D`: chance.** Random unit vectors have cosine about `N(0, 1/D)`, so one noise
+unit is `1/√D`.
+
+- `estimatorNoise = 1/√D`
+- `significanceBar = 3/√D`, three noise units above chance
+- `conceptThreshold = 0.5 + 0.5/√D`, for halo concept sharing: the structural
+  midpoint plus half a noise unit
+- `mergeThreshold = 1 − 1/√D`
+- `profileCapacity = ⌊√D⌋`, the terms a superposition holds before each falls
+  below noise
+
+**`W`: the perception quantum.** Below one window, a byte overlap is chance.
+
+- `identityBar(D, W, len) = max(mergeThreshold, 1 − W/len)`
+- `reachThreshold = 1 − 1/(2W)`
+- canonical windows of `W−1` and `W` bytes, and `chainReach = W²`
+
+**`N`: commonness,** with `corpusN = max(2, edge sources)`.
+
+- `hubBound = ⌈√N⌉`, the bound on every `LIMIT` read (`hubCap` on lists)
+- `consensusFloor = ln N + ½`, for pooled climb votes
+- `atomReach = max(1, ⌈N·W/256⌉)`; an atom is a hub when `atomReach > hubBound`
+
+`dominates(part, whole) = 2·part > whole` is the one scale-free bar: a strict
+majority.
+
+The vector bars are compared against RaBitQ estimates, not exact cosines. That
+is benign for inequality gates over broad regions, and it is why no bar ever
+decides identity (`exact-vs-approximate.md`).
+
+The formulas live in `src/geometry.ts`, `src/mind/traverse.ts` (corpus scale)
+and `src/mind/canonical.ts` (windows). A new bar is added there, never to
+`config.ts`.
 
 ## Two derivations that bite
 
-**1. `identityBar` is scale-aware.** A fixed cosine `1-1/√D` over a `4·√D`-byte
-span tolerates four whole windows of foreign bytes while still claiming
-"near-identical". An identity claim may tolerate at most one window `W` (the
-perception quantum, same budget as `differsByOneWindow` in near-dedup), so the
-bar must be `1-W/len` floored at `mergeThreshold`. Reusing `mergeThreshold` for
-a whole-span claim silently widens the byte budget with span length.
-
-**2. `consensusFloor` is priced for pooled climb votes, not for support
-counts.** Each region contributes at most `ln(N/c) ≤ ln(N)`; `ln(N)+½` demands
-corroboration beyond one maximally-specific region. `chooseNext`'s `bestSupport`
-(`prevCount` of one destination) is N-invariant — bounded by retellings of that
-fact, not by `N`. Gating it against `consensusFloor` guarantees failure once `N`
-is large enough (observed: 2-vs-1-1-1 corroboration refused at N≈325K, falling
-back to a noisy concept-hop).
+**`identityBar` must scale with length.** A fixed cosine of `1 − 1/√D` over a
+`4·√D`-byte span tolerates four whole windows of foreign bytes while still
+claiming near-identity. An identity claim may tolerate at most one window (`W`),
+so the bar is `1 − W/len`, floored at `mergeThreshold`. Reusing `mergeThreshold`
+for a whole-span claim silently widens the tolerance as the span grows.
+
+**A bar is priced for one quantity only.** `consensusFloor` is calibrated for
+pooled climb votes, where each region contributes at most `ln(N/c) ≤ ln N`, so
+`ln N + ½` asks for corroboration beyond one maximally specific region.
+`chooseNext`'s support count is different: it is bounded by retellings of one
+fact and does not grow with `N`. Gating that count by `consensusFloor` must
+eventually fail, and it did: at N≈325K, a 2-against-1-1-1 corroboration was
+refused, and the answer fell back to a noisy concept hop.
 
 ## Pins
 
-- `test/40-choosenext-scale-guard` — `consensusFloor` must not gate `chooseNext`
-  support counts.
-- `test/64-two-ended-thresholds` — `mergeThreshold` / `identityBar` /
-  `reachThreshold` derivations and the scale-aware floor.
-- `test/78-atom-hub-recognition-cliff` — `atomReach` / `atomIsHub` hub
-  abstention at scale.
+- `test/64` — `mergeThreshold`, `identityBar` and `reachThreshold`, and the
+  scale-aware floor.
+- `test/40` — `consensusFloor` must not gate `chooseNext`'s support counts.
+- `test/78` — `atomReach`/`atomIsHub`: atoms abstain once the corpus makes them
+  hubs.