@modernrelay/orbit-core 0.13.6 → 0.15.0

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { G as GraphSnapshot, A as AcceptedGraph, R as ResolvedGroup, a as GraphDiagnostic, b as GraphNode, c as AcceptedEdge, N as NodeId, M as MetaEdge, S as SceneFold, d as GroupSpec, e as GroupBySpec, f as SceneGroups, g as RenderScene, h as SceneLinkRef, i as ScenePointRef, j as Accessor, k as RevisionAwareService, l as RequestContext, m as SearchResult, V as ViewportState, n as SelectionState, o as SubgraphSpec, J as JsonValue, E as EngineFactory, p as ExpansionService, P as PathService, q as ScaleLimits, r as GraphTheme, s as GraphStoreState, L as LabelPlacement, t as GraphHostUpdate, B as BeginIngestOptions, I as IngestSession, u as GraphEventName, v as GraphEventMap, w as GraphListenerControl, x as EdgeId, y as GraphPerfSnapshot, z as ResolvedCluster, C as PathOptions, D as PathResult, F as SearchActivation, H as CrossfilterSession, T as TimelinePlayback, K as Scale, O as MetricName, Q as Revisions, U as AccessibilityConfig, W as ThemeInput, X as LabelConfig, Y as IngestBatch, Z as RevisionDimension, _ as FilterSpec, $ as FilterExpr, a0 as DimensionSpec, a1 as BrushState, a2 as DimensionSummary, a3 as DomainPolicy, a4 as EngineBufferChannel, a5 as GraphEngine, a6 as EngineCommit, a7 as EngineCapabilities, a8 as MetricColumn, a9 as ColumnarGraphSnapshot, aa as GraphSnapshotInput } from './index-BoQfS8jd.js';
-export { ab as AppendReceipt, ac as CategoryBin, ad as ClusterSpec, ae as Column, af as ColumnChange, ag as DIAGNOSTIC_SAMPLE_CAP, ah as DegradeEvent, ai as DegradeStep, aj as DiagnosticCode, ak as DiagnosticSeverity, al as DimensionKind, am as ErrorPhase, an as ExpansionBatch, ao as ExpansionResponse, ap as FilterMode, aq as FilterValue, ar as GraphEdge, as as GraphError, at as GraphOperationError, au as HistogramBin, av as IngestCommitReceipt, aw as IngestSessionState, ax as InstanceStatus, ay as LayoutKind, az as NodeEventPayload, aA as OrbitOperationError, aB as ResourceAdmissionReport, aC as ResourceDegradeStep, aD as SearchUnavailableReason, aE as SimulationConfig, aF as StringColumn, aG as graphErrorToError, aH as isFatalGraphError, aI as resourceLimitFatal } from './index-BoQfS8jd.js';
-import { W as WorkerFactoryOption } from './lane-SZYhcrXT.js';
-export { C as ClusterDerivation, D as DEFAULT_CLUSTER_CENTER_RADIUS, a as DEFAULT_LAYOUT_SEED, E as EncodedStringTable, R as RequestClass, b as WorkerEntity, c as WorkerEnvelope, d as WorkerTransport, e as clusterCentroids, f as collectTransfers, g as decodeStringTable, h as deriveClusters, i as encodeStringTable, j as generateClusterCenters, k as judgeEpoch, r as resolveClusterCenters } from './lane-SZYhcrXT.js';
+import { G as GraphSnapshot, A as AcceptedGraph, R as ResolvedGroup, a as GraphDiagnostic, b as GraphNode, c as AcceptedEdge, N as NodeId, M as MetaEdge, S as SceneFold, d as GroupSpec, e as GroupBySpec, f as SceneGroups, g as RenderScene, h as SceneLinkRef, i as ScenePointRef, j as Accessor, k as RevisionAwareService, l as RequestContext, m as SearchResult, V as ViewportState, n as SelectionState, o as SubgraphSpec, J as JsonValue, E as EngineFactory, p as ExpansionService, P as PathService, q as ScaleLimits, r as GraphTheme, s as GraphStoreState, L as LabelPlacement, t as GraphHostUpdate, B as BeginIngestOptions, I as IngestSession, u as GraphEventName, v as GraphEventMap, w as GraphListenerControl, x as EdgeId, y as GraphPerfSnapshot, z as ResolvedCluster, C as PathOptions, D as PathResult, F as SearchActivation, H as CrossfilterSession, T as TimelinePlayback, K as Scale, O as MetricName, Q as Revisions, U as AccessibilityConfig, W as ThemeInput, X as LabelConfig, Y as IngestBatch, Z as RevisionDimension, _ as FilterSpec, $ as FilterExpr, a0 as DimensionSpec, a1 as BrushState, a2 as DimensionSummary, a3 as DomainPolicy, a4 as EngineBufferChannel, a5 as GraphEngine, a6 as EngineCommit, a7 as EngineCapabilities, a8 as MetricColumn, a9 as ColumnarGraphSnapshot, aa as GraphSnapshotInput } from './index-CPRTWpGA.js';
+export { ab as AppendReceipt, ac as CategoryBin, ad as ClusterSpec, ae as Column, af as ColumnChange, ag as DIAGNOSTIC_SAMPLE_CAP, ah as DegradeEvent, ai as DegradeStep, aj as DiagnosticCode, ak as DiagnosticSeverity, al as DimensionKind, am as ErrorPhase, an as ExpansionBatch, ao as ExpansionResponse, ap as FilterMode, aq as FilterValue, ar as GraphEdge, as as GraphError, at as GraphOperationError, au as HistogramBin, av as IngestCommitReceipt, aw as IngestSessionState, ax as InstanceStatus, ay as LayoutKind, az as NodeEventPayload, aA as OrbitOperationError, aB as ResourceAdmissionReport, aC as ResourceDegradeStep, aD as SearchUnavailableReason, aE as SimulationConfig, aF as StringColumn, aG as graphErrorToError, aH as isFatalGraphError, aI as resourceLimitFatal } from './index-CPRTWpGA.js';
+import { W as WorkerFactoryOption } from './lane-_KPQ1deI.js';
+export { C as ClusterDerivation, D as DEFAULT_CLUSTER_CENTER_RADIUS, a as DEFAULT_LAYOUT_SEED, E as EncodedStringTable, R as RequestClass, b as WorkerEntity, c as WorkerEnvelope, d as WorkerTransport, e as clusterCentroids, f as collectTransfers, g as decodeStringTable, h as deriveClusters, i as encodeStringTable, j as generateClusterCenters, k as judgeEpoch, r as resolveClusterCenters } from './lane-_KPQ1deI.js';
 import { StoreApi } from 'zustand/vanilla';
 
 /**
- * §5.1 snapshot validation — deterministic malformed-input resolution.
+ * snapshot validation — deterministic malformed-input resolution.
  *
  * Pure function: same input → structurally identical output; never throws on
  * malformed input. Diagnostics are batched — at most one GraphDiagnostic per
@@ -16,7 +16,7 @@ import { StoreApi } from 'zustand/vanilla';
 declare function validateSnapshot<N = Record<string, unknown>, E = Record<string, unknown>>(snapshot: GraphSnapshot<N, E>): AcceptedGraph<N, E>;
 
 /**
- * §16.3 stage-3 containment rewrite (S12-T01) — pure derivation, no engine,
+ * stage-3 containment rewrite — pure derivation, no engine,
  * no DOM.
  *
  * ## The representative forest
@@ -37,35 +37,35 @@ declare function validateSnapshot<N = Record<string, unknown>, E = Record<string
  * why nesting needs no special case (a fold inside a collapsed group hides
  * with it, and its members' edges route to the group).
  *
- * Contract summary (spec §16.3/§7.6 stage 3, invariants E5):
+ * Contract summary:
  * - Groups are HIERARCHICAL but singly-parented: a member id may name another
- *   group (nesting), but no entity has two parents. `validateGroupSpecs`
- *   rejects a violating array with ONE batched §5.1 'config-error' diagnostic
- *   BEFORE any scene rewrite — a rejected array changes nothing.
- * - `rewriteGroups` runs over the HARD-SCOPED model (§7.6 stage 2 output):
- *   collapsed representatives replace their in-scope descendants with one row
- *   (a synthetic super-node, or the fold anchor's existing physical row);
- *   descendant edges re-route into meta-edge rows carrying the underlying-edge
- *   count (the badge datum). The post-rewrite graph feeds the EXISTING §7.2
- *   structural diff, so collapse/expand is a diff, never a reload.
- * - Group ids occupy a distinct PUBLIC namespace (§7.4): synthetic rows carry
- *   INTERNAL scene keys (NUL-prefixed — outside the documented caller id
- *   contract) that never escape public payloads. A group id equal to a node
- *   id coexists without collision. A FOLD anchor is a real node, so its
- *   entity key IS its node id and it needs no synthetic slot at all.
+ * group (nesting), but no entity has two parents. `validateGroupSpecs`
+ * rejects a violating array with ONE batched 'config-error' diagnostic
+ * BEFORE any scene rewrite — a rejected array changes nothing.
+ * - `rewriteGroups` runs over the HARD-SCOPED model:
+ * collapsed representatives replace their in-scope descendants with one row
+ * (a synthetic super-node, or the fold anchor's existing physical row);
+ * descendant edges re-route into meta-edge rows carrying the underlying-edge
+ * count (the badge datum). The post-rewrite graph feeds the EXISTING
+ * structural diff, so collapse/expand is a diff, never a reload.
+ * - Group ids occupy a distinct PUBLIC namespace: synthetic rows carry
+ * INTERNAL scene keys (NUL-prefixed — outside the documented caller id
+ * contract) that never escape public payloads. A group id equal to a node
+ * id coexists without collision. A FOLD anchor is a real node, so its
+ * entity key IS its node id and it needs no synthetic slot at all.
  * - Synthetic rows are never cast to N/E: they carry only `id`, and consumers
- *   identify them by slot position — synthetics are always a CONTIGUOUS
- *   SUFFIX of the node/edge lists (physical prefix ordering is preserved), so
- *   `slot >= physicalCount` is the discrimination rule.
+ * identify them by slot position — synthetics are always a CONTIGUOUS
+ * SUFFIX of the node/edge lists (physical prefix ordering is preserved), so
+ * `slot >= physicalCount` is the discrimination rule.
  */
 
 /** Internal scene key of a collapsed group's super-node row. NEVER public. */
 declare function groupSceneKey(groupId: string): string;
 /** Internal scene key of a meta-edge row (directed rewritten endpoint pair). */
 declare function metaEdgeSceneKey(sourceKey: string, targetKey: string): string;
-/** §16.3 PUBLIC meta-edge id: the collision-safe ordered endpoint tuple
+/** PUBLIC meta-edge id: the collision-safe ordered endpoint tuple
  * `JSON.stringify(['meta-edge', source.kind, source.id, target.kind,
- * target.id])` — shared with the parallel-edge grouping toggle (R-16.3-24). */
+ * target.id])` — shared with the parallel-edge grouping toggle. */
 declare function metaEdgePublicId(sourceKind: 'node' | 'group', sourceId: string, targetKind: 'node' | 'group', targetId: string): string;
 /**
  * Entity key: a physical node id, or a synthetic group scene key. A fold
@@ -102,16 +102,16 @@ interface GroupValidationResult {
 /**
  * Validates a manual `groups` array against the FULL accepted model (members
  * may live outside the current hard scope). Violations, all collected into
- * one diagnostic (§5.1 delivery contract — never one event per bad row):
+ * one diagnostic:
  * - duplicate group id in the array;
  * - self-membership (a group naming its own id — rejected even when a node
- *   with that id exists: the ambiguity itself is the error);
+ * with that id exists: the ambiguity itself is the error);
  * - duplicate membership (the same node twice in one group);
  * - overlapping membership (the same node in two groups);
  * - CYCLIC nesting (groups that contain each other, directly or through a
- *   chain — the containment forest must stay acyclic);
+ * chain — the containment forest must stay acyclic);
  * - unknown members (ids absent from the accepted model AND not naming
- *   another group; with no accepted model every non-group member is unknown).
+ * another group; with no accepted model every non-group member is unknown).
  *
  * NESTING IS LEGAL: a member id naming another group id nests that group.
  * Containment is a forest, not a partition — but it stays SINGLY PARENTED,
@@ -126,14 +126,14 @@ declare function validateGroupSpecs(specs: readonly GroupSpec[], nodeIndex: Read
  */
 declare function resolveManualGroups(specs: readonly GroupSpec[], nodeIndex: ReadonlyMap<NodeId, number>): ResolvedGroup[];
 /** Canonical structural equality for the groups HOST LANE (GroupSpec is a
- * plain descriptor like Scale — equal literals never re-rewrite, §6.1). */
+ * plain descriptor like Scale — equal literals never re-rewrite). */
 declare function sameGroupSpecArrays(a: readonly GroupSpec[] | null, b: readonly GroupSpec[] | null): boolean;
 /**
- * R-16.3-14 collision-safe derived-group id codec: `JSON.stringify(['group',
+ * collision-safe derived-group id codec: `JSON.stringify(['group',
  * key])`. Injective over keys (JSON string encoding), never equal to the raw
  * key itself (every output starts with `["group",`), and round-trippable via
  * JSON.parse. Labels stay separate — the derived group's `label` is the raw
- * key. Group ids remain a distinct public namespace (§7.4), so a NODE id that
+ * key. Group ids remain a distinct public namespace, so a NODE id that
  * happens to equal a derived id still coexists without collision.
  */
 declare function groupByDerivedId(key: string): string;
@@ -142,8 +142,8 @@ declare function groupByDerivedId(key: string): string;
 declare function sameGroupBySpec<N>(a: GroupBySpec<N> | null, b: GroupBySpec<N> | null): boolean;
 /**
  * D4 boundary validation for a groupBy spec: `by` must be a function and
- * `semanticZoom.expandAbove` must be STRICTLY greater than `collapseBelow`
- * (the §16.3 hysteresis contract T05 builds on). Returns ONE batched
+ * `semanticZoom.expandAbove` must be STRICTLY greater than `collapseBelow`.
+ * Returns ONE batched
  * 'config-error' diagnostic (the rejected spec never lands — the previous
  * groupBy configuration stays active) or null when valid.
  */
@@ -152,21 +152,21 @@ interface GroupByDerivation {
     /** One derived group per distinct key, first-encounter order over the
      * model's node list. `collapsed` comes from the caller's residue lookup. */
     groups: readonly ResolvedGroup[];
-    /** Derived PUBLIC id → derived key (the setGroupCollapsed reverse map —
-     * the residue is keyed by KEY, never by id, R-16.3-16). */
+    /** Derived PUBLIC id → derived key (the setGroupCollapsed reverse map;
+     * the residue is keyed by KEY, never by id). */
     keyById: ReadonlyMap<string, string>;
     /** ONE aggregated 'accessor-error' warning when `by` threw (the affected
      * nodes derive as ungrouped — never silent loss, I3), else null. */
     diagnostic: GraphDiagnostic | null;
 }
 /**
- * §16.3 groupBy derivation: one GroupSpec-shaped ResolvedGroup per distinct
- * string key returned by `by` (first-encounter order, matching §11
+ * groupBy derivation: one GroupSpec-shaped ResolvedGroup per distinct
+ * string key returned by `by` (first-encounter order, matching
  * categorical-domain conventions); `null` — and any non-string value — means
  * ungrouped. Derived ids use {@link groupByDerivedId}; `label` is the raw
  * key; `derived: true` marks membership read-only. `collapsed` defaults to
  * whatever `isCollapsedKey` reports — with an empty residue everything is
- * expanded, so adding groupBy alone changes no rendering (R-16.3-13).
+ * expanded, so adding groupBy alone changes no rendering.
  */
 declare function deriveGroupsByKey<N>(nodes: readonly GraphNode<N>[], by: (node: GraphNode<N>) => string | null, isCollapsedKey: (key: string) => boolean): GroupByDerivation;
 interface SuperNodeRecord {
@@ -182,15 +182,15 @@ interface SuperNodeRecord {
 interface MetaEdgeRecord {
     /** Internal scene key of the meta-edge row (never public). */
     sceneKey: string;
-    /** Public record (§7.4 payload surface): endpoints are PUBLIC ids — a
+    /** Public record: endpoints are PUBLIC ids — a
      * group id or a node id — and `count` is the badge datum. */
     metaEdge: MetaEdge;
-    /** Indices of the rerouted edges in the PRE-rewrite model's edge list —
+    /** Indices of the rerouted edges in the PRE-rewrite model's edge list
      * the stage-5 "any underlying edge passes" rule evaluates these. */
     underlying: readonly number[];
 }
 interface GroupRewrite<N = Record<string, unknown>, E = Record<string, unknown>> {
-    /** The post-rewrite scene model — what feeds the §7.2 structural diff. */
+    /** The post-rewrite scene model — what feeds the structural diff. */
     graph: AcceptedGraph<N, E>;
     /** Physical rows (same objects as the input model's, members removed). */
     physicalNodes: readonly GraphNode<N>[];
@@ -212,7 +212,7 @@ interface GroupRewrite<N = Record<string, unknown>, E = Record<string, unknown>>
 }
 /**
  * Rewrites the collapsed representatives of `forest` over the hard-scoped
- * model (§7.6 stage 3). Returns null when nothing collapsed intersects the
+ * model. Returns null when nothing collapsed intersects the
  * model — an uncollapsed group exists only in store.groups and never
  * rewrites the scene.
  *
@@ -224,7 +224,7 @@ interface GroupRewrite<N = Record<string, unknown>, E = Record<string, unknown>>
  * cached by construction: they re-derive from the unchanged accepted model on
  * expand. Synthetic rows carry no positions; the reconciler's departed cache
  * restores a re-collapsed super-node (stable scene key) and returning members
- * exactly like any other leave-and-return (§7.3).
+ * exactly like any other leave-and-return.
  */
 declare function rewriteGroups<N, E>(model: AcceptedGraph<N, E>, forest: RepForest): GroupRewrite<N, E> | null;
 /**
@@ -233,12 +233,12 @@ declare function rewriteGroups<N, E>(model: AcceptedGraph<N, E>, forest: RepFore
  * groups-empty rewrite when none is active). Returns `base` unchanged when
  * no pair has multiplicity > 1 — the toggle is then a scene no-op.
  *
- * Meta-edge identity reuses the T01 codecs: public id
- * `metaEdgePublicId('node', source, 'node', target)` (the R-16.3-24 tuple),
+ * Meta-edge identity reuses the group codecs: public id
+ * `metaEdgePublicId('node', source, 'node', target)`,
  * internal scene key `metaEdgeSceneKey(source, target)`. `count` (the badge
- * datum) is the collapsed multiplicity and drives the T01 aggregate width
+ * datum) is the collapsed multiplicity and drives the aggregate width
  * channel; `underlying` indexes the PRE-rewrite model's edge list so the
- * stage-5 "any underlying edge passes" mask rule applies unchanged.
+ * "any underlying edge passes" mask rule applies unchanged.
  */
 declare function collapseParallelEdges<N, E>(model: AcceptedGraph<N, E>, base: GroupRewrite<N, E> | null): GroupRewrite<N, E> | null;
 /** The RenderScene.groups descriptor for a rewrite. */
@@ -250,9 +250,9 @@ declare function scenePointRefAt(scene: RenderScene, index: number): ScenePointR
 declare function sceneLinkRefAt(scene: RenderScene, linkIndex: number): SceneLinkRef | null;
 
 /**
- * §7 reconciler — id↔index model, structural diff, position cache.
+ * reconciler — id↔index model, structural diff, position cache.
  *
- * v0.1 implements the 'rebuild' index policy only (§7.3): every reconcile
+ * v0.1 implements the 'rebuild' index policy only: every reconcile
  * rebuilds the flat buffers from scratch in accepted-base order, preserving
  * positions by id via the live/departed caches. Pure data-structure work: no
  * DOM, no engine import.
@@ -283,27 +283,27 @@ declare class Reconciler {
     private prevLinks;
     /**
      * Declared node.x/y as of the previous reconcile, for nodes that declared
-     * them. Lets Priority 1 distinguish a CHANGED declaration (caller intent —
+     * them. Lets Priority 1 distinguish a CHANGED declaration (caller intent
      * wins over any cache) from an unchanged one (defers to live drift). Fresh
      * per pass, so departed ids drop and a re-add treats its declaration as new.
      */
     private prevDeclared;
     /**
-     * CPU position mirror for the CURRENT scene, indexed by slot (§7.1 posBuf).
+     * CPU position mirror for the CURRENT scene, indexed by slot.
      * Owned copy — never aliases a published scene's positions array, so
      * noteEnginePositions never mutates an already-published RenderScene.
      */
     private livePositions;
     /**
-     * Ids removed from the scene → last known finite position (§7.1/§7.3
-     * leave-and-return guarantee). Map insertion order doubles as LRU order;
+     * Ids removed from the scene → last known finite position, preserving the
+     * leave-and-return guarantee. Map insertion order doubles as LRU order;
      * invariant: never overlaps the current scene's id set.
      */
     private readonly departed;
     reconcile<N, E>(accepted: AcceptedGraph<N, E>): ReconcileResult;
     /**
      * Copy engine-read positions into the live cache for the CURRENT scene's
-     * slots (§7.1 per-event readback — simulation end, pre-structural-swap).
+     * slots.
      * Extra trailing floats are ignored; a short buffer updates a prefix.
      */
     noteEnginePositions(positions: Float32Array): void;
@@ -311,12 +311,12 @@ declare class Reconciler {
 }
 
 /**
- * §8 projection (v0.1 subset): styling accessors → engine-ready typed buffers.
+ * projection (v0.1 subset): styling accessors → engine-ready typed buffers.
  *
  * Pure and DOM-free. Color parsing covers the CSS subset orbit documents
- * (hex, rgb()/rgba(), hsl()/hsla(), small named map); anything else is a
+ * (hex, rgb/rgba, hsl/hsla, small named map); anything else is a
  * caller error surfaced as a batched 'accessor-error' diagnostic, never a
- * throw and never a NaN in a GPU buffer (§8 numeric hygiene).
+ * throw and never a NaN in a GPU buffer.
  */
 
 type RGBA = [number, number, number, number];
@@ -337,11 +337,11 @@ declare function projectSizes<T>(items: readonly T[], accessor: Accessor<T, numb
 };
 
 /**
- * §16.5 search — the SearchService contract plus the built-in LOCAL indexed
- * service (S11-T06).
+ * search — the SearchService contract plus the built-in LOCAL indexed
+ * service.
  *
  * The default service is client-side and field-scoped: it indexes the node id
- * ALWAYS plus `attrs[field]` (String()-coerced) for each field the host
+ * ALWAYS plus `attrs[field]` (String-coerced) for each field the host
  * declared via `searchIndex` — it never guesses privileged attr names, so a
  * missing declaration leaves the service id-only. Matching is a
  * case-insensitive SUBSTRING scan over ONE precomputed lowercase haystack per
@@ -359,25 +359,25 @@ declare function projectSizes<T>(items: readonly T[], accessor: Accessor<T, numb
  *
  * `ctx.signal` is honored between scan chunks (an awaited microtask every
  * {@link SEARCH_SCAN_CHUNK} nodes) — abort is an optimization; the instance's
- * admission gate is the correctness gate (§9.2). Nothing here touches the
+ * admission gate is the correctness gate. Nothing here touches the
  * engine, the store, or the DOM.
  */
 
-/** §16.5 search resolver: custom services plug in server-side search
- * (Omnigraph B.7); the instance owns RequestContext creation, revision-keyed
+/** Search resolver: custom services plug in server-side search; the instance
+ * owns RequestContext creation, revision-keyed
  * caching, supersede cancellation, and stale-result rejection at admission. */
 interface SearchService<N = Record<string, unknown>> extends RevisionAwareService {
     search(q: string, options: {
         limit: number;
     }, ctx: RequestContext): Promise<readonly SearchResult<N>[]>;
 }
-/** Accepted-base view the local service indexes (thunked for lazy wiring —
+/** Accepted-base view the local service indexes (thunked for lazy wiring
  * the instance re-reads it on every call, so the service can be constructed
  * before any data arrives). */
 interface LocalSearchBase<N = Record<string, unknown>> {
     /** Accepted-model nodes in accepted-base order (the tie-break order). */
     nodes: readonly GraphNode<N>[];
-    /** §16.5 declared attr fields; undefined = id-only search (the service
+    /** declared attr fields; undefined = id-only search (the service
      * never guesses attr names). */
     searchIndex: readonly string[] | undefined;
 }
@@ -393,7 +393,7 @@ declare const SEARCH_SCORE_TOKEN_START_BONUS = 0.25;
 /** Nodes scanned between cooperative yields (awaited microtask + signal check). */
 declare const SEARCH_SCAN_CHUNK = 4096;
 /**
- * Creates the §16.5 default indexed search service over the accepted model.
+ * Creates the default indexed search service over the accepted model.
  * Declares `revisionDependencies: ['source', 'model']` — the index keys on
  * `ctx.modelRevision` (plus the declared field list), so it builds at most
  * once per model revision and a stale-model result is discarded by the
@@ -403,7 +403,7 @@ declare const SEARCH_SCAN_CHUNK = 4096;
 declare function createLocalSearchService<N = Record<string, unknown>>(getBase: () => LocalSearchBase<N>): LocalSearchService<N>;
 
 /**
- * §8 image-atlas pipeline (S10-T09) — pure core side.
+ * image-atlas pipeline — pure core side.
  *
  * Turns per-point image refs (stable strings from the synchronous `nodeImage`
  * accessor) into engine-ready atlas resources: resolved ImageBitmaps with
@@ -411,27 +411,27 @@ declare function createLocalSearchService<N = Record<string, unknown>>(getBase:
  * only ever sees the output shape (`EngineCommit.resources`); everything
  * async — resolve, fetch, decode, retry, abort — stays here.
  *
- * Invariants (spec §8):
- *  - Loads are deduplicated by ref: one in-flight resolve per unique ref.
- *  - Slots are allocated per unique ref from a free-list capped at
- *    `maxEntries`; over-cap refs stay placeholder and are diagnosed once per
- *    generation.
- *  - Results are admission-checked against the current request state before
- *    atlas admission; the abort signal is an optimization, admission is the
- *    gate (a resolver that ignores its signal cannot poison a newer
- *    generation).
- *  - Transient resolver/fetch failures retry up to `maxRetries`; decode
- *    failures are final.
- *  - Failures are cadence-batched: ONE `image-resolve-failed` diagnostic per
- *    flush with a count and sampled refs, each ref counted once per
- *    generation. Failures never poison the engine commit.
- *  - A resolver-returned string is a final URL/data URI fetched + decoded
- *    exactly once — never recursively passed back to the resolver.
+ * Invariants:
+ * - Loads are deduplicated by ref: one in-flight resolve per unique ref.
+ * - Slots are allocated per unique ref from a free-list capped at
+ * `maxEntries`; over-cap refs stay placeholder and are diagnosed once per
+ * generation.
+ * - Results are admission-checked against the current request state before
+ * atlas admission; the abort signal is an optimization, admission is the
+ * gate (a resolver that ignores its signal cannot poison a newer
+ * generation).
+ * - Transient resolver/fetch failures retry up to `maxRetries`; decode
+ * failures are final.
+ * - Failures are cadence-batched: ONE `image-resolve-failed` diagnostic per
+ * flush with a count and sampled refs, each ref counted once per
+ * generation. Failures never poison the engine commit.
+ * - A resolver-returned string is a final URL/data URI fetched + decoded
+ * exactly once — never recursively passed back to the resolver.
  */
 
 /**
  * Owns authenticated fetch / caching / redirect handling for one ref
- * (spec §8, Appendix B.6). Returning a Blob hands the bytes straight to
+ * under the public resolver contract. Returning a Blob hands the bytes straight to
  * decode; returning a string names a FINAL URL or data URI that the pipeline
  * fetches + decodes once (it is never re-resolved).
  */
@@ -446,7 +446,7 @@ type FetchLike = (url: string, init: {
 }>;
 /** Blob → ImageBitmap. Injectable so Node tests never touch createImageBitmap. */
 type ImageDecode = (blob: Blob) => Promise<ImageBitmap>;
-/** One coalesced flush of atlas work — mirrors `EngineCommit.resources` (§13). */
+/** One coalesced flush of atlas work — mirrors `EngineCommit.resources`. */
 interface ImageAtlasBatch {
     /** Newly resolved bitmaps with their slot assignments. */
     upserts: readonly {
@@ -508,7 +508,7 @@ declare class ImageAtlasPipeline {
     private generation;
     private flushScheduled;
     private disposed;
-    /** D5/F11-06: evicted-entry bitmaps awaiting close — closed AFTER the
+    /** Evicted-entry bitmaps awaiting close — closed AFTER the
      * flush that carries their removeSlots, so the instance's recovery-replay
      * map (pruned synchronously in the batch callback) can never re-send a
      * closed bitmap. */
@@ -542,7 +542,7 @@ declare class ImageAtlasPipeline {
     /** -1 (placeholder) until the ref's bitmap is delivered or in this batch. */
     private buildPointIndex;
     /**
-     * I2 (roster-atomic resource mappings, F11-03): the SYNCHRONOUS point→slot
+     * Roster-atomic resource mappings: the SYNCHRONOUS point→slot
      * mapping for the last requested roster — a slot appears only when its ref
      * is resolved AND the engine has already received the bitmap (delivered);
      * pending, failed, evicted, and reused-but-undelivered refs are the −1
@@ -555,7 +555,7 @@ declare class ImageAtlasPipeline {
 }
 
 /**
- * §16.14 view state (S15 view-state lane) — pure module: the serialized
+ * View state — pure module: the serialized
  * schema, the canonical-JSON encoder, the structural validator, and the
  * version gate. No engine, no DOM, no store access; the instance wires
  * `getViewState`/`setViewState` on top.
@@ -564,33 +564,33 @@ declare class ImageAtlasPipeline {
  *
  * Deep-links outlive library versions, so everything in this file is a
  * COMMITMENT, not an internal:
- *  - The v1 wire shape below never changes incompatibly; breaking shape
- *    changes bump `v` and ship an in-code migration from every prior version
- *    in the same release (the registry seam is here from day one).
- *  - Additive fields never bump `v` — an equal-`v` payload with unknown
- *    fields applies cleanly with the unknowns ignored.
- *  - A payload with `v` HIGHER than this library knows, or failing structural
- *    validation (hand-edited URL, truncated paste), is rejected whole: a
- *    half-restored view misrepresents what the sender saw (§16.14).
+ * - The v1 wire shape below never changes incompatibly; breaking shape
+ * changes bump `v` and ship an in-code migration from every prior version
+ * in the same release (the registry seam is here from day one).
+ * - Additive fields never bump `v` — an equal-`v` payload with unknown
+ * fields applies cleanly with the unknowns ignored.
+ * - A payload with `v` HIGHER than this library knows, or failing structural
+ * validation (hand-edited URL, truncated paste), is rejected whole: a
+ * half-restored view misrepresents what the sender saw.
  *
  * ## v1 shape notes
  *
- *  - `folds` extends the spec's v1 schema (amendment logged with this slice):
- *    §16.3 node folds are exploration state over stable public ids — a
- *    deep-link that silently dropped them would misrepresent the sender's
- *    view, the exact failure this feature exists to prevent. Session-local
- *    expansion records, by contrast, are NEVER serialized (R-16.3-08).
- *  - Brushes are TAGGED on the wire (`kind`) even though the runtime
- *    BrushState is untagged: the tag comes from `DimensionSpec.kind` at
- *    serialize time and lets restore validate shape-vs-dimension without
- *    consulting the live spec first. Categorical stores EXCLUSIONS, so
- *    categories that appear after the view was saved stay visible.
- *  - `layout` is the normalized OBJECT form (`{ kind }`) even though the
- *    runtime today carries only the bare kind string — the object is what
- *    makes a future static seed or a layouts package additive.
+ * - `folds` extends the v1 schema:
+ * node folds are exploration state over stable public ids — a
+ * deep-link that silently dropped them would misrepresent the sender's
+ * view, the exact failure this feature exists to prevent. Session-local
+ * expansion records, by contrast, are NEVER serialized.
+ * - Brushes are TAGGED on the wire (`kind`) even though the runtime
+ * BrushState is untagged: the tag comes from `DimensionSpec.kind` at
+ * serialize time and lets restore validate shape-vs-dimension without
+ * consulting the live spec first. Categorical stores EXCLUSIONS, so
+ * categories that appear after the view was saved stay visible.
+ * - `layout` is the normalized OBJECT form (`{ kind }`) even though the
+ * runtime today carries only the bare kind string — the object is what
+ * makes a future static seed or a layouts package additive.
  */
 
-/** Tagged wire form of a crossfilter brush (§16.6 → §16.14). */
+/** Tagged wire form of a crossfilter brush for view-state serialization. */
 type ViewBrushState = {
     kind: 'numeric' | 'temporal';
     range: readonly [number, number];
@@ -603,23 +603,31 @@ type ViewBrushState = {
 interface ViewLayoutSpec {
     kind: 'force' | 'fixed';
 }
-/** §11 Scale subset that is data by construction (no functions). */
-type SerializableScale = {
-    kind: 'sequential' | 'diverging';
+type SerializableScaleFor<T extends string | number> = {
+    kind: 'sequential';
+    metric: string;
+    range: readonly [T, T];
+    domain?: readonly [number, number];
+} | {
+    kind: 'diverging';
     metric: string;
-    range: readonly string[] | readonly number[];
-    domain?: readonly number[];
-    mid?: number;
+    range: readonly [T, T, T];
+    mid: number;
 } | {
     kind: 'categorical';
     /** Field-descriptor form only — a function `by` is omitted upstream. */
     by: string;
-    palette?: readonly string[] | readonly number[];
+    palette?: readonly T[];
     domain?: readonly string[];
 };
+/** Scale subset that is data by construction (no functions). `T` is bound
+ * by the styling channel: CSS strings for nodeColor, finite numbers for
+ * nodeSize. Tuple arity mirrors the runtime Scale<T> contract exactly. The
+ * conditional preserves homogeneous value collections when `T` is a union. */
+type SerializableScale<T extends string | number = string | number> = T extends unknown ? SerializableScaleFor<T> : never;
 interface ViewStyling {
-    nodeColor?: SerializableScale;
-    nodeSize?: SerializableScale;
+    nodeColor?: SerializableScale<string>;
+    nodeSize?: SerializableScale<number>;
     showLinks?: boolean;
     edgeArrows?: boolean;
     /** Named themes only; a custom GraphTheme object is omitted upstream. */
@@ -630,16 +638,16 @@ interface GraphViewState {
     camera: ViewportState | null;
     selection: SelectionState;
     hiddenNodeIds: readonly NodeId[];
-    /** §9.2 isolation; null = full scope. */
+    /** isolation; null = full scope. */
     subgraph: SubgraphSpec | null;
     /** Manual groups verbatim, or — under `groupBy` — `{key, collapsed}` pairs
-     * only (membership recomputes from current data on restore, R-16.3-16). */
+     * only (membership recomputes from current data on restore). */
     groups: readonly GroupSpec[] | ReadonlyArray<{
         key: string;
         collapsed: boolean;
     }>;
     pinnedNodeIds: readonly NodeId[];
-    /** §16.3 node folds: anchor → declared members (v1 extension, see header). */
+    /** node folds: anchor → declared members (v1 extension, see header). */
     folds?: ReadonlyArray<readonly [NodeId, readonly NodeId[]]>;
     layout: ViewLayoutSpec;
     /** Declaration order; a key absent here has no brush. */
@@ -653,7 +661,7 @@ interface GraphViewState {
     positions?: ReadonlyArray<readonly [string, number, number]>;
     styling?: ViewStyling;
     /** Host-owned durable source coordinate — stored verbatim, NEVER
-     * interpreted; compared canonically on restore (§16.14). */
+     * interpreted; compared canonically on restore. */
     dataRef?: JsonValue;
 }
 declare const VIEW_STATE_VERSION: 1;
@@ -664,8 +672,8 @@ declare const VIEW_STATE_VERSION: 1;
  * their canonical strings are identical.
  */
 declare function canonicalJson(value: JsonValue | undefined): string | undefined;
-/** Canonical equality for dataRef values (§16.14): key order never matters.
- * A non-JSON value (cycles included) is never equal to anything — the §5
+/** Canonical equality for dataRef values: key order never matters.
+ * A non-JSON value (cycles included) is never equal to anything — the
  * "compared, never interpreted" rule extended to malformed input. */
 declare function sameDataRef(a: JsonValue | undefined, b: JsonValue | undefined): boolean;
 type ViewStateVerdict = {
@@ -677,7 +685,7 @@ type ViewStateVerdict = {
     problems: readonly string[];
 };
 /**
- * Full structural validation + version gate. Order per §16.14: version first
+ * Full structural validation + version gate. Order per version first
  * (higher-than-known and non-numeric reject as `unsupported-version` /
  * `invalid-view-state` BEFORE field checks), then per-field structure. Lower
  * versions run the migration registry, then re-validate at the current shape.
@@ -693,7 +701,7 @@ type SetViewStateResult = {
 } | {
     status: 'rejected';
     code: 'invalid-view-state' | 'unsupported-version'
-    /** The state touches a §6.4 controlled slice or carries styling the
+    /** The state touches a controlled slice or carries styling the
      * host must reflect, and no aggregate restore callback exists. */
      | 'missing-restore-callback'
     /** Another restore/history transaction is awaiting acknowledgement. */
@@ -706,28 +714,28 @@ type SetViewStateResult = {
 };
 
 /**
- * §6 GraphInstance — the public headless core instance (v0.3 subset).
+ * GraphInstance — the public headless core instance (v0.3 subset).
  *
  * One `applyHostUpdate` call is the atomic host boundary: it validates,
  * reconciles, re-projects only dirty channels, and publishes EXACTLY ONE store
- * `set()` and AT MOST ONE engine commit, so a simultaneous data + style +
- * controlled-state change can never tear across frames (§6).
+ * `set` and AT MOST ONE engine commit, so a simultaneous data + style +
+ * controlled-state change can never tear across frames.
  *
- * Vanilla zustand only — no React, no DOM access at module scope (§18).
+ * Vanilla zustand only — no React, no DOM access at module scope.
  */
 
-/** §8 dark base theme (the default when no base is named). */
+/** dark base theme (the default when no base is named). */
 declare const GRAPH_THEME_DARK: GraphTheme;
-/** §8 light base theme. */
+/** light base theme. */
 declare const GRAPH_THEME_LIGHT: GraphTheme;
 /**
- * Resolve a ThemeInput to a full GraphTheme (§8): pick the named base
+ * Resolve a ThemeInput to a full GraphTheme: pick the named base
  * (default dark), then merge every defined token over it. A full GraphTheme
  * input resolves to exactly its own tokens; `undefined` resolves to the dark
  * base; the v0.1 `{background}` compat shorthand merges as a partial.
  */
 declare function resolveTheme(input?: ThemeInput): GraphTheme;
-/** One categorical legend row (§11): declared-domain rows first (including
+/** One categorical legend row: declared-domain rows first (including
  * currently-empty categories), then extra seen values sorted. */
 interface ScaleInfoRow {
     value: string;
@@ -745,50 +753,50 @@ interface ScaleChannelInfo<N = Record<string, unknown>> {
     /** Categorical rows; omitted for sequential/diverging scales. */
     rows?: readonly ScaleInfoRow[];
 }
-/** §9.2 revision-aware service seam (expansion since v0.5, search since S11). */
+/** Revision-aware service seam for expansion and search. */
 interface GraphServices<N = Record<string, unknown>, E = Record<string, unknown>> {
     /**
      * Ego-expansion resolver for `expandNode` / `SubgraphSpec.hops`. Default:
-     * the built-in LOCAL service — it walks the core's §7.1 adjacency over the
+     * the built-in LOCAL service — it walks the core's adjacency over the
      * accepted model, INCLUDING currently out-of-scope nodes (zero config,
      * zero network; the core still never fetches).
      */
     expansion?: ExpansionService<N, E>;
     /**
-     * §16.2 path resolver for `findPath`. Default: the built-in LOCAL
+     * path resolver for `findPath`. Default: the built-in LOCAL
      * unweighted BFS over the loaded VISIBLE edge list, respecting
      * PathOptions.direction. Revision-aware: a result arriving after a
-     * dataset replacement is discarded at admission (S12-T08).
+     * dataset replacement is discarded at admission.
      */
     path?: PathService;
     /**
-     * §16.5 search resolver for `instance.search`. Default: the built-in LOCAL
+     * search resolver for `instance.search`. Default: the built-in LOCAL
      * indexed service over the accepted model plus the host's declared
      * `searchIndex` fields (id-only when never declared — it never guesses
      * attr names; zero config, zero network). Custom services plug in
-     * server-side search (Omnigraph B.7) with the same instance-side
-     * correctness: RequestContext, revision-keyed caching, supersede
+     * server-side search (such as Omnigraph stored queries) with the same
+     * instance-side correctness: RequestContext, revision-keyed caching, supersede
      * cancellation, stale rejection at admission.
      */
     search?: SearchService<N>;
 }
 interface CreateGraphInstanceOptions<N = Record<string, unknown>, E = Record<string, unknown>> {
-    /** Called once per mount; a re-attach constructs a fresh engine (§6). */
+    /** Called once per mount; a re-attach constructs a fresh engine. */
     engine: EngineFactory;
     /** Fit the camera once when the first data-bearing commit reaches a fresh engine. Default true. */
     fitViewOnFirstData?: boolean;
-    /** §9.2 revision-aware services (expansion + §16.5 search). */
+    /** revision-aware services (expansion + search). */
     services?: GraphServices<N, E>;
     /**
-     * §16.5 node attr fields the DEFAULT search service indexes (ids always;
+     * node attr fields the DEFAULT search service indexes (ids always;
      * absent = id-only — the service never guesses attr names). CONSTRUCTION-
-     * ONLY per the spec's host construction options (D7): read once here;
+     * ONLY as a host construction option: read once here;
      * changing it requires a keyed remount / replacement instance. A runtime
      * `applyHostUpdate` attempt is ignored with a one-shot warning.
      */
     searchIndex?: readonly string[];
     /**
-     * §16.14 undo/redo (S9-T20). Default true. `false` makes the history
+     * undo/redo. Default true. `false` makes the history
      * surface inert (record/undo/redo no-ops, depths stay 0); an object sets
      * the stack bound (default {@link HISTORY_LIMIT_DEFAULT} entries).
      */
@@ -796,42 +804,42 @@ interface CreateGraphInstanceOptions<N = Record<string, unknown>, E = Record<str
         limit?: number;
     };
     /**
-     * §17/§6.1 degradation-ladder thresholds (S13-T08). CONSTRUCTION-ONLY
-     * (D7): read once; invalid fields fall back to the spec defaults with ONE
+     * Degradation-ladder thresholds. CONSTRUCTION-ONLY: read once; invalid
+     * fields fall back to the defaults with ONE
      * config warning diagnostic. A runtime change requires a keyed remount.
      */
     limits?: Partial<ScaleLimits>;
     /**
-     * §8 image-atlas resolver seam (S10): owns authenticated fetch/caching for
+     * Image-atlas resolver seam: owns authenticated fetch/caching for
      * one `nodeImage` ref. Default: plain `fetch(ref)` for public URLs.
      * Injectable for tests and authenticated hosts.
      */
     imageResolver?: ImageResolver;
     /**
-     * §6.1/§17 execution mode (ADR-006 D1; CONSTRUCTION-ONLY, D7). Current
-     * worker cargo: columnar ACCEPTANCE (validate + dedupe + link resolution
-     * off-thread; §7.5-style async admission). 'main' (default) keeps every
+     * Execution mode. Current worker cargo is columnar ACCEPTANCE: validation,
+     * deduplication, and link resolution run off-thread, then land through
+     * revision-gated async admission. 'main' (default) keeps every
      * columnar ingest synchronous; 'auto' and 'worker' route columnar data
      * through the worker lane when it boots — an unavailable lane degrades
      * to 'main' with one `worker-unavailable` info diagnostic under 'auto'
-     * and an ERROR diagnostic under 'worker' (which never silently falls
-     * back on channel work, but acceptance has no worker-REQUIRED semantics
-     * yet — channel projection cargo is the registered follow-up).
+     * and an ERROR diagnostic under 'worker'. Columnar acceptance may still
+     * fall back because it has no worker-required mode; channel projection
+     * remains on the main thread.
      */
     execution?: 'auto' | 'main' | 'worker';
-    /** ADR-006 D5 worker construction tri-option (URL / factory / inline
+    /** Worker construction tri-option (URL / factory / inline
      * default). Testing seam: `transport` on the lane via this factory. */
     workerFactory?: WorkerFactoryOption;
 }
 /**
- * `expandNode` outcome (§9.2/§16.3):
- *  - `{ added }` — the admitted result merged; `added` counts the nodes it
- *    made newly visible in the current scope.
- *  - `{ noop: true }` — every returned neighbor was already visible in the
- *    current scope (T17); no session was opened, nothing changed.
- *  - `{ coalesced: true }` — reserved. v0.5 same-id coalescing hands the
- *    SECOND caller the IDENTICAL in-flight promise, so both callers observe
- *    the primary call's `{added}`/`{noop}` result instead of this marker.
+ * `expandNode` outcome:
+ * - `{ added }` — the admitted result merged; `added` counts the nodes it
+ * made newly visible in the current scope.
+ * - `{ noop: true }` — every returned neighbor was already visible in the
+ * current scope; no session was opened and nothing changed.
+ * - `{ coalesced: true }` — reserved. v0.5 same-id coalescing hands the
+ * SECOND caller the IDENTICAL in-flight promise, so both callers observe
+ * the primary call's `{added}`/`{noop}` result instead of this marker.
  */
 type ExpandNodeResult = {
     added: number;
@@ -841,7 +849,7 @@ type ExpandNodeResult = {
     noop: true;
 };
 /**
- * §9.2 expansion bookkeeping: one committed expansion overlay. Data-merging
+ * expansion bookkeeping: one committed expansion overlay. Data-merging
  * batches carry the request id (overlayId + batch ids) and provenance into
  * ingestion so abort, rollback, and removeOverlay remove the exact
  * contribution they own.
@@ -855,11 +863,11 @@ interface ExpansionOverlayRecord {
     provenance?: unknown;
 }
 /**
- * §14 overlay label lane subscriptions. Two channels with distinct cadences:
- *  - `subscribeCandidates` fires ONLY when the candidate SET (ids/text/forced)
- *    changes — the throttled re-rank. React re-renders label content here.
- *  - `subscribePositions` fires on scheduler ticks (host `onFrame`) with fresh
- *    x/y for the SAME set — imperative transform writes, NO React re-render.
+ * overlay label lane subscriptions. Two channels with distinct cadences:
+ * - `subscribeCandidates` fires ONLY when the candidate SET (ids/text/forced)
+ * changes — the throttled re-rank. React re-renders label content here.
+ * - `subscribePositions` fires on scheduler ticks (host `onFrame`) with fresh
+ * x/y for the SAME set — imperative transform writes, NO React re-render.
  * Both replay the current state synchronously on subscribe. The emitted array
  * and its placement objects are REUSED across position ticks — copy if you
  * need a snapshot.
@@ -869,20 +877,20 @@ interface LabelSubscriptions {
     subscribePositions(cb: (list: readonly LabelPlacement[]) => void): () => void;
 }
 interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>> {
-    /** Vanilla zustand store — the single observable state surface (§6.3). */
+    /** Vanilla zustand store — the single observable state surface. */
     readonly store: StoreApi<GraphStoreState>;
-    /** §14 DOM label lane (overlay scheduler output). */
+    /** DOM label lane (overlay scheduler output). */
     readonly labels: LabelSubscriptions;
-    /** Atomic host transaction: one store publication, at most one engine commit (§6). */
+    /** Atomic host transaction: one store publication, at most one engine commit. */
     applyHostUpdate(update: GraphHostUpdate<N, E>): void;
     /**
-     * §7.5 revisioned ingestion: begin a bounded, cancellable session against an
+     * revisioned ingestion: begin a bounded, cancellable session against an
      * explicit `datasetKey` and `baseModelRevision` (compare-and-set; mismatch
      * throws 'stale-revision'). Overlay sessions must name the CURRENT
      * datasetKey; replace sessions may establish a new one and are always
      * atomic.
      *
-     * T16 rule: while a declarative data source is actively driving (a snapshot
+     * While a declarative data source is actively driving (a snapshot
      * was applied through `applyHostUpdate` and has not been superseded by a
      * committed replace session), `purpose:'replace'` is rejected at begin with
      * a TypeError — two writers may not race for the base. Overlay ingestion
@@ -890,11 +898,11 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      *
      * Every session admission/publication is serialized through the
      * instance-local acceptance queue; arrival there is the global admission
-     * order (§7.5).
+     * order.
      */
     beginIngest(opts: BeginIngestOptions): IngestSession<N, E>;
     /**
-     * §7.5: atomically remove exactly one committed overlay — re-runs collision
+     * atomically remove exactly one committed overlay — re-runs collision
      * and endpoint resolution, promotes formerly shadowed rows from surviving
      * overlays, advances model/render revisions, and releases the overlayId for
      * deliberate reuse. Unknown ids are an idempotent `{ removed: false }`.
@@ -902,14 +910,14 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
     removeOverlay(overlayId: string): {
         removed: boolean;
     };
-    /** Committed overlay ids for the current dataset (§7.5). */
+    /** Committed overlay ids for the current dataset. */
     getOverlayIds(): readonly string[];
     attach(container: HTMLElement): Promise<void>;
     detach(): void;
     destroy(): void;
     /**
-     * §15 typed events: listeners run SYNCHRONOUSLY in registration order; the
-     * control's preventDefault() cancels ONLY the built-in follow-up (click
+     * typed events: listeners run SYNCHRONOUSLY in registration order; the
+     * control's preventDefault cancels ONLY the built-in follow-up (click
      * selection, drag pin), never other listeners.
      */
     on<K extends GraphEventName>(name: K, cb: (payload: GraphEventMap<N, E>[K], control: GraphListenerControl) => void): () => void;
@@ -918,51 +926,51 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
     zoomOut(): void;
     setViewport(v: Partial<ViewportState>): void;
     /**
-     * §16 focus neighborhood (T10): keep the v0.1 camera behavior
+     * Focus neighborhood: keep the v0.1 camera behavior
      * (setFocusedIndex + zoomToIndex) and RETURN the 1-hop neighbor ids
      * (engine adjacency when available, else the core CSR adjacency).
      *
-     * Documented compromise: the engine exposes ONE highlight channel until S10
-     * styling lands, so the neighbor ring is pushed through setSelectedIndices
+     * Documented compromise: the engine exposes ONE highlight channel, so the
+     * neighbor ring is pushed through setSelectedIndices
      * ONLY when that cannot lie about real selection state — selection empty
      * and uncontrolled. The ring is a visual, never a store write; the next
      * selection push overwrites it. Opt out via `highlightNeighbors: false`.
-     * `hops` is reserved at 1 until multi-hop lands.
+     * Only `hops: 1` is currently supported.
      */
     focusNode(id: NodeId, opts?: {
         highlightNeighbors?: boolean;
         hops?: 1;
     }): readonly NodeId[];
     /**
-     * §13 emphasis ring WITHOUT the camera: ring `id` (null clears). The light
+     * emphasis ring WITHOUT the camera: ring `id` (null clears). The light
      * op keyboard navigation needs — arrowing a list must not fly the camera on
      * every keystroke (`focusNode` stays ring + zoom + neighbors). Unknown ids
      * are a silent no-op (a stale row racing a model swap is data, not an
      * error); `emphasisRing: false` suppresses it entirely. The target is
      * STICKY: it survives structural commits and context recovery until it is
      * cleared, its id departs the model, or pointer hover supersedes it
-     * (emphasis belongs to the latest action — the §16.2 rule).
+     * (emphasis belongs to the latest action — the rule).
      */
     emphasizeNode(id: NodeId | null): void;
     /**
-     * §14/§15 typed context-menu channel, opened from a DOM presenter. Label
+     * Typed context-menu channel, opened from a DOM presenter. Label
      * divs are `pointerEvents: 'auto'` by design (click-to-focus), so a
      * right-click on one never reaches the engine canvas — without this seam
      * the nodes prominent enough to carry labels are exactly the ones whose
      * right-click falls through to the browser's native menu. Emits the SAME
      * 'contextMenu' event the canvas gesture produces; `screen` is
-     * container-relative CSS px (the §15 payload contract). Unknown ids are a
+     * container-relative CSS px. Unknown ids are a
      * silent no-op (a stale label racing a model swap is data, not an error).
      */
     requestNodeContextMenu(id: NodeId, screen: readonly [number, number]): void;
     setSelection(ids: readonly NodeId[] | SelectionState): void;
     selectNodes(ids: readonly NodeId[]): void;
     selectEdges(ids: readonly EdgeId[]): void;
-    /** §16.2 group namespace (S12-T02): validate against the CURRENT resolved
+    /** group namespace: validate against the CURRENT resolved
      * groups (unknown ids dropped, duplicates collapse) and store in
      * groups-array order — the group analog of accepted-base ordering. Never
      * touches the node/edge namespaces; the group namespace is always
-     * instance-owned (§6.4 controlled selection covers nodes only). */
+     * instance-owned. */
     selectGroups(ids: readonly string[]): void;
     /** Expand to the 1-hop neighborhood of `id` (or of the current selection). */
     selectNeighbors(id?: NodeId): void;
@@ -970,9 +978,9 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
     invertSelection(): void;
     clearSelection(): void;
     /**
-     * §16.2 lasso (S6-T05): resolve the SCREEN-coordinate polygon to node ids
+     * lasso: resolve the SCREEN-coordinate polygon to node ids
      * via `engine.pointsInPolygon`, drop hidden ids, then replace (default) or
-     * union (`additive`) the node selection through the same §6.4 ownership
+     * union (`additive`) the node selection through the same ownership
      * path as every other mutator (controlled → intent only). Returns the
      * resolved lasso ids (accepted-base order) regardless of ownership; empty
      * when the engine is not ready or lacks `pointsInPolygon`.
@@ -992,19 +1000,19 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      * tolerance. No-op (null) on the native route. */
     sampleEdgeClick(screen: readonly [number, number]): AcceptedEdge<E> | null;
     /**
-     * @internal §15/§17 shared hit-test/overlay cadence: the count of engine
+     * @internal Shared hit-test/overlay cadence: the count of engine
      * onFrame ticks this session. THE one clock every sampling route throttles
      * against (node hover and link picking share it by construction — there is
-     * no second cadence timer anywhere; the S13-T06 lint rule enforces it).
-     * The S13 ladder's defer-link-picking arms/disarms against this counter;
-     * §17 telemetry reads it for idle-wakeup accounting.
+     * no second cadence timer anywhere; the lint rule enforces it).
+     * The degradation ladder's defer-link-picking step arms/disarms against this counter;
+     * telemetry reads it for idle-wakeup accounting.
      */
     getFrameCadence(): number;
     /**
-     * @internal F10-02 op counters (live object — snapshot before comparing):
-     * the perf-gate-delta suite proves the brush fast path does O(Δ) work —
-     * zero full recomposes/refreshes/cascades across a scrub. §17 telemetry
-     * (S13-T07) will fold these into `lastCommitMs`-adjacent accounting.
+     * @internal op counters (live object — snapshot before comparing):
+     * the perf-gate-delta suite proves the brush fast path does O(Δ) work
+     * zero full recomposes/refreshes/cascades across a scrub. telemetry
+     * will fold these into `lastCommitMs`-adjacent accounting.
      */
     getPerfCounters(): Readonly<{
         brushSlotsTranslated: number;
@@ -1014,12 +1022,12 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
         fullEdgeRecomposes: number;
     }>;
     /**
-     * §17 telemetry snapshot (S13-T07): counts, byte estimates, queue depth,
+     * telemetry snapshot: counts, byte estimates, queue depth,
      * revisions, last-commit phase decomposition, active ladder steps,
      * execution lane, range availability, and the pressure mirror — never raw
      * attrs or ids. Synchronous in every lifecycle state (pre-scene fields
      * read zero/absent). `validate` is folded into `derive` until the
-     * columnar lane splits acceptance from derivation (PR-E).
+     * columnar lane splits acceptance from derivation.
      */
     getPerfSnapshot(): GraphPerfSnapshot;
     hideNodes(ids: readonly NodeId[]): void;
@@ -1028,24 +1036,24 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
     pinNode(id: NodeId, xy?: readonly [number, number]): void;
     unpinNode(id: NodeId): void;
     clearPins(): void;
-    /** §16.3 PERSISTENT pins (S12-T09): pin ids AT THEIR CURRENT POSITION via
+    /** PERSISTENT pins: pin ids AT THEIR CURRENT POSITION via
      * engine.setPinnedIndices — no position payload in v0.10. Independent of
      * transient drag pinning (`pins`): the engine receives the UNION of both
-     * slices, so releasing a drag pin leaves a persistent pin held. §6.4
+     * slices, so releasing a drag pin leaves a persistent pin held.
      * ownership mirrors groups: once the host supplies `pinnedNodeIds` (null
      * included) the ops fire the 'pinnedChange' intent instead of writing.
      * Unknown ids drop; departed ids prune through the ownership path on
-     * model changes (R-16.3-25). */
+     * model changes. */
     pinNodes(ids: readonly NodeId[]): void;
     /** Release persistent pins (see {@link pinNodes}); unpinned ids no-op. */
     unpinNodes(ids: readonly NodeId[]): void;
-    /** Add one group definition (same §16.3 acyclic/singly-parented validation as the
+    /** Add one group definition (same acyclic/singly-parented validation as the
      * `groups` prop — a violating spec is ONE 'config-error' and a no-op). */
     groupNodes(spec: GroupSpec): void;
     /** Remove one group definition; its id prunes from SelectionState.groupIds
      * through the ownership path. Unknown ids no-op (dev-mode warning). */
     ungroup(groupId: string): void;
-    /** Collapse/expand one group as a §7.2 structural diff. Works on manual
+    /** Collapse/expand one group as a structural diff. Works on manual
      * groups AND groupBy-derived groups (the residue toggle). Same-value
      * calls are exact no-ops (zero publishes, zero commits). */
     setGroupCollapsed(groupId: string, collapsed: boolean): void;
@@ -1059,12 +1067,12 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      * rejected, since that would close a containment cycle).
      *
      * One publish and at most one structural commit (E1). A no-member fold is
-     * an exact no-op. Records a §16.14 'folds' history step.
+     * an exact no-op. Records a 'folds' history step.
      */
     foldNode(id: NodeId, opts?: {
         memberIds?: readonly NodeId[];
     }): void;
-    /** Unfolds `id`, returning its members to the scene as a §7.2 structural
+    /** Unfolds `id`, returning its members to the scene as a structural
      * diff. Unknown or unfolded ids are exact no-ops. */
     unfoldNode(id: NodeId): void;
     /** The members `id` currently stands for, or null when it is not folded.
@@ -1075,30 +1083,30 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
     } | null;
     /** Current stage-4 clusters over the physical scene: ordered keys, member
      * ids, the force center labels anchor to while hot, and the settled
-     * centroid (null until a §7.1 readback or a fixed-layout commit). Empty
+     * centroid (null until a readback or a fixed-layout commit). Empty
      * when no `clusters` spec is active. Clusters synthesize nothing — the
-     * scene is byte-identical with and without a spec (R-16.3-17/19). */
+     * scene is byte-identical with and without a spec. */
     getClusters(): readonly ResolvedCluster[];
-    /** R-16.3-18: resolve a cluster (by key) to its MEMBER node ids and write
-     * them into SelectionState.nodeIds through the standard §6.4 ownership
+    /** resolve a cluster (by key) to its MEMBER node ids and write
+     * them into SelectionState.nodeIds through the standard ownership
      * path — clusters have no id namespace of their own in selection.
      * `additive` unions with the current node selection. Unknown keys no-op. */
     selectCluster(key: string, opts?: {
         additive?: boolean;
     }): void;
     /**
-     * §9.2 isolate: hard-scope the graph to the CURRENT node selection —
+     * isolate: hard-scope the graph to the CURRENT node selection
      * `subgraph: { seedIds: selection.nodeIds }` through the SAME path as the
      * host-update prop. No-op when nothing is selected. Ownership note (v0.5):
      * `subgraph` is UNCONTROLLED-ONLY — always instance-owned; the prop and
      * this method write the same state, last writer wins.
      */
     isolateSelection(): void;
-    /** §9.2: clear the hard scope (`subgraph: null`) — the full accepted model
-     * returns with cached positions (§9.4-style identity for kept ids). */
+    /** clear the hard scope (`subgraph: null`) — the full accepted model
+     * returns with cached positions. */
     resetIsolation(): void;
     /**
-     * §9.2/§16.3 ego-expansion of `id` (default 1 hop) through the configured
+     * Ego-expansion of `id` (default 1 hop) through the configured
      * ExpansionService. The result is gated by admission (declared revision
      * dependencies + dataset lineage + seed existence — abort is only an
      * optimization) and merges through ONE awaited atomic overlay
@@ -1117,8 +1125,8 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      * Undoes `id`'s own expansions — the navigation Back button, NOT a
      * containment operation. Aborts `id`'s pending expansion AND explicitly
      * removes the overlays its past expansions committed (plus their scope
-     * accretion). Committed overlay DATA otherwise persists per §7.5 until
-     * removeOverlay / a replacing snapshot; this IS that explicit removal for
+     * accretion). Committed overlay DATA otherwise persists until
+     * `removeOverlay()` or a replacing snapshot; this IS that explicit removal for
      * expansion overlays.
      *
      * On a node that was never expanded from, this does nothing — there is no
@@ -1127,7 +1135,7 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      * different word for navigation history.
      */
     retractExpansion(id: NodeId): void;
-    /** §9.2 expansion bookkeeping for `id`: committed overlay records with
+    /** expansion bookkeeping for `id`: committed overlay records with
      * request id, provenance, and the ids each expansion revealed. */
     getExpansionOverlays(id: NodeId): readonly ExpansionOverlayRecord[];
     /**
@@ -1136,21 +1144,21 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      * `serviceCacheKey` over EXACTLY the service's declared revision
      * dimensions ({@link SEARCH_CACHE_LIMIT}-entry LRU; a second call with an
      * equal key while one is in flight coalesces onto the same service call),
-     * cancels superseded work (a NEWER query aborts the older in-flight call —
+     * cancels superseded work (a NEWER query aborts the older in-flight call
      * the older promise rejects `OrbitOperationError {code:'aborted'}`), and
      * rejects stale results at admission (declared revision drift or dataset
      * lineage change → the same typed 'aborted' rejection with a distinct
      * staleness message; the store is untouched). A successful search
      * publishes `store.search = {query, results}` — `node` populated for
      * in-model ids — in ONE store publication. Search NEVER changes
-     * scope/filter semantics and never fetches graph data (§16.5).
+     * scope/filter semantics and never fetches graph data.
      */
     search(query: string, opts?: {
         limit?: number;
     }): Promise<readonly SearchResult<N>[]>;
     /** Clear `store.search` to null (e.g. the <GraphSearch> input emptied). */
     clearSearch(): void;
-    /** §16.2 path query + atomic emphasis (S12-T08): resolves via the path
+    /** path query + atomic emphasis: resolves via the path
      * service (local BFS default); null = unreachable (a RESULT). Emphasis is
      * session-local — released by clearPath, any selection mutation, undo/
      * redo, or a scene rebuild; never a history step; never serialized. */
@@ -1158,21 +1166,21 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
     clearPath(): void;
     getActivePath(): PathResult | null;
     /**
-     * §16.5 result contract (T07): a result id in the current rendered scene
-     * AND §9.1 mask-visible is focused (`focusNode`) → `{status:'focused'}`.
+     * Result contract: a result id in the current rendered scene
+     * AND mask-visible is focused (`focusNode`) → `{status:'focused'}`.
      * Otherwise classification ONLY — 'not-loaded' (absent from the accepted
      * model), 'out-of-scope' (in the model but outside the hard scope),
      * 'filtered' (in the scene but mask-hidden). Never mutates scope or
-     * filters — the host reacts explicitly (§16.5).
+     * filters — the host reacts explicitly.
      */
     activateSearchResult(result: SearchResult<N>): SearchActivation;
     pauseSimulation(): void;
     resumeSimulation(): void;
     isSimulationRunning(): boolean;
-    /** §16.1 screenshot: delegates to the engine; null when unsupported/not ready. */
+    /** screenshot: delegates to the engine; null when unsupported/not ready. */
     captureScreenshot(): Promise<Blob | null>;
     /**
-     * §15.1 binding-detected reduced-motion media preference. The EFFECTIVE
+     * binding-detected reduced-motion media preference. The EFFECTIVE
      * value is `accessibility.reducedMotion ?? v` — when reduced, camera
      * durations (fitView/setViewport/focusNode) coerce to 0.
      */
@@ -1180,7 +1188,7 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
     /**
      * The crossfilter session facade, or null until the `crossfilter` prop has
      * configured dimensions over an accepted base. Delegates to the
-     * typed-column engine; `setBrush` routes visibility deltas into the §9.1
+     * typed-column engine; `setBrush` routes visibility deltas into the
      * soft mask (buffers-only commit, zero relayout) and resolves after the
      * publish. Brush slot deltas are BASE indices; under a hard scope
      * out-of-scope rows have no scene slot and simply do not mask anything.
@@ -1200,12 +1208,12 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
     /** Re-apply the most recently undone entry. False when nothing to redo. */
     redo(): boolean;
     /**
-     * Serialize the exploration state (§16.14): camera, selection, hidden ids,
+     * Serialize the exploration state: camera, selection, hidden ids,
      * isolation, groups (manual specs verbatim; under `groupBy` only collapsed
      * `{key, collapsed}` pairs — membership recomputes on restore), pins,
      * folds, layout, crossfilter brushes in declaration order, the Scale-valued
      * styling subset, and the host's `dataRef` verbatim. The predicate `filter`
-     * and §16.3 expansion records are never serialized. The sync form carries
+     * and expansion records are never serialized. The sync form carries
      * no positions: reproduction is best-effort via the layout descriptor.
      */
     getViewState(opts?: {
@@ -1213,7 +1221,7 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
     }): GraphViewState;
     /**
      * Async form: additionally embeds quantized coordinates for the VISIBLE
-     * (post-mask) set, read once from the engine (per-event readback, ADR-001).
+     * (post-mask) set, read once from the engine as event-time readback.
      * Restores as a frozen fixed-equivalent — pixel-faithful regardless of
      * engine nondeterminism. Past `maxPositions` (default 100 000) the call
      * rejects `export-materialization-too-large`; persist the layout through
@@ -1224,7 +1232,7 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
         maxPositions?: number;
     }): Promise<GraphViewState>;
     /**
-     * Atomically restore a serialized view (§16.14). NEVER partially applies:
+     * Atomically restore a serialized view. NEVER partially applies:
      * structural validation and the version gate run first (reject whole with
      * one 'invalid-view-state' diagnostic); then the dataRef canonical
      * comparison — a mismatch fires the 'viewStateMismatch' event INSTEAD of
@@ -1233,7 +1241,7 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      * undo/redo uses, so a restore is itself undoable. Embedded positions
      * apply as a frozen fixed-equivalent (one replay-style commit, then the
      * simulation pauses — a later explicit layout change or reheat unfreezes).
-     * A state touching a §6.4 controlled slice (or styling, once a restore
+     * A state touching a controlled slice (or styling, once a restore
      * callback exists) resolves 'missing-restore-callback' until the aggregate
      * protocol is registered.
      */
@@ -1272,14 +1280,14 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      * entity over ONE pinned revision — a mid-stream commit never mixes
      * epochs. Closing the generator releases the pin. */
     exportDataStream(scope?: 'visible' | 'accepted'): AsyncGenerator<string, void, undefined>;
-    /** Bounded id → [x, y] map from one position readback (§7.1 per-event). */
+    /** Bounded id → [x, y] map from one position readback. */
     exportLayout(opts?: {
         limit?: number;
     }): Promise<ReadonlyMap<NodeId, readonly [number, number]>>;
     /** Memory-bounded `{"id","x","y"}` JSONL over one pinned readback. */
     exportLayoutStream(): AsyncGenerator<string, void, undefined>;
     /**
-     * §11 legend surface: the active Scale on a styling channel plus its
+     * legend surface: the active Scale on a styling channel plus its
      * resolved domain (sequential/diverging — resolved through the SAME frozen
      * DomainStore coordinate the projection uses) or categorical legend rows
      * (declared-domain order first including empty categories, then extra seen
@@ -1288,9 +1296,9 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      */
     getScaleInfo(channel: 'nodeColor' | 'nodeSize'): ScaleChannelInfo<N> | null;
     /**
-     * §12 metric read for one node id via the core id→index map (never a
-     * public million-entry Map). Null for unknown ids/metrics and §8-null
-     * values; lazily computes the degree family on first use.
+     * metric read for one node id via the core id→index map (never a
+     * public million-entry Map). Null for unknown ids, unknown metrics, and
+     * null values; lazily computes the degree family on first use.
      */
     getMetricValue(metric: MetricName, id: NodeId): number | null;
     getRevisions(): Revisions;
@@ -1300,54 +1308,54 @@ interface GraphInstance<N = Record<string, unknown>, E = Record<string, unknown>
      * way a hover/selection consumer resolves `store.hover.edgeId` or
      * `selection.edgeIds` to real records. Undefined for unknown ids. */
     getEdge(id: EdgeId): AcceptedEdge<E> | undefined;
-    /** Scene ids that are §9.1 mask-visible (scope ∧ mask), scene order. */
+    /** Scene ids that are mask-visible (scope ∧ mask), scene order. */
     getVisibleNodeIds(): readonly NodeId[];
-    /** Scene roster: scope applied, mask NOT applied — the §15.1 navigator's
+    /** Scene roster: scope applied, mask NOT applied — the navigator's
      * entry list, which must still LIST masked/hidden nodes and expose their
      * state in text rather than dropping them. */
     getSceneNodeIds(): readonly NodeId[];
-    /** §15.1 accessibility config stash (navigator/live-region consumers). */
+    /** accessibility config stash (navigator/live-region consumers). */
     getAccessibility(): AccessibilityConfig<N> | undefined;
 }
-/** §16.14: consecutive same-dimension brush moves within this window merge
+/** consecutive same-dimension brush moves within this window merge
  * into one history entry (scrub/drag coalescing). */
 declare const BRUSH_HISTORY_COALESCE_MS = 500;
-/** §16.6 timeline defaults (S9-T10). */
+/** timeline defaults. */
 declare const TIMELINE_TICK_MS_DEFAULT = 100;
 declare const TIMELINE_STEP_DEFAULT = 0.01;
-/** §16.5 search defaults (S11-T06). */
+/** search defaults. */
 declare const SEARCH_LIMIT_DEFAULT = 20;
 declare const SEARCH_CACHE_LIMIT = 32;
 declare function createGraphInstance<N = Record<string, unknown>, E = Record<string, unknown>>(opts: CreateGraphInstanceOptions<N, E>): GraphInstance<N, E>;
 
 /**
- * §14 DOM label lane — pure candidate selection (S7-T01/T16).
+ * DOM label lane — pure candidate selection.
  *
  * `selectLabelCandidates` is a pure, deterministic ranking function: no engine,
  * no DOM, no store. The instance-side overlay scheduler calls it on THROTTLED
- * re-rank triggers only (viewport idle, model change, config change, settle) —
+ * re-rank triggers only (viewport idle, model change, config change, settle)
  * NEVER per frame. Positions are the reconciler's CPU cache (space coords);
  * per-frame work elsewhere is a pure O(k) projection of the winners.
  *
- * Selection rules (§14):
- *  - Zoom-LOD: below `minZoom` the lane is empty EXCEPT `showFor` ids, which
- *    bypass the zoom gate but stay viewport-culled.
- *  - `showFor` claims capacity FIRST in accepted-base order. When the
- *    in-viewport `showFor` set alone exceeds capacity k, accepted-base order
- *    wins deterministically and `overloadCount` reports the omissions (one
- *    `label-overload` diagnostic upstream — no winner churn).
- *  - Remaining capacity fills with viewport-visible nodes ranked by
- *    `getWeight` (else degree), ties broken by accepted-base order.
- *  - Visibility comes from the engine's `pointsInRect` when available, else a
- *    CPU cull of cached positions through the viewport transform. Nodes with
- *    unknown (NaN) cached positions are unplaceable on the CPU path.
+ * Selection rules:
+ * - Zoom-LOD: below `minZoom` the lane is empty EXCEPT `showFor` ids, which
+ * bypass the zoom gate but stay viewport-culled.
+ * - `showFor` claims capacity FIRST in accepted-base order. When the
+ * in-viewport `showFor` set alone exceeds capacity k, accepted-base order
+ * wins deterministically and `overloadCount` reports the omissions (one
+ * `label-overload` diagnostic upstream — no winner churn).
+ * - Remaining capacity fills with viewport-visible nodes ranked by
+ * `getWeight` (else degree), ties broken by accepted-base order.
+ * - Visibility comes from the engine's `pointsInRect` when available, else a
+ * CPU cull of cached positions through the viewport transform. Nodes with
+ * unknown (NaN) cached positions are unplaceable on the CPU path.
  */
 
 /** A capacity winner before per-frame projection assigns screen coordinates. */
 type LabelCandidate = Omit<LabelPlacement, 'x' | 'y'>;
-/** §14 default ranked-candidate cap. */
+/** default ranked-candidate cap. */
 declare const LABEL_MAX_VISIBLE_DEFAULT = 64;
-/** §14 policy maximum for `maxVisible`. */
+/** policy maximum for `maxVisible`. */
 declare const LABEL_MAX_VISIBLE_CAP = 1024;
 interface LabelCandidateViewport {
     zoom: number;
@@ -1360,7 +1368,7 @@ interface SelectLabelCandidatesArgs<N = Record<string, unknown>> {
     scene: RenderScene;
     /**
      * Accepted nodes in accepted-base order. Under the 'rebuild' index policy
-     * (§7.3) scene index i IS accepted-base position i, so `nodes[i]` is the
+     * scene index i IS accepted-base position i, so `nodes[i]` is the
      * node behind `scene.idByIndex[i]`.
      */
     nodes: readonly GraphNode<N>[];
@@ -1385,11 +1393,11 @@ interface LabelCandidateResult {
 declare function selectLabelCandidates<N = Record<string, unknown>>(args: SelectLabelCandidatesArgs<N>): LabelCandidateResult;
 
 /**
- * §7.1/§13 CSR adjacency over columnar link buffers.
+ * CSR adjacency over columnar link buffers.
  *
- * Pure, engine-free helpers shared by local expansion (§9.2), incident-edge
- * dirtying (§9.1), and the engine-facing `neighborIndices` interaction helper
- * (§13). Build is O(L) via two counting passes over the flat
+ * Pure, engine-free helpers shared by local expansion, incident-edge
+ * dirtying, and the engine-facing `neighborIndices` interaction helper.
+ * Build is O(L) via two counting passes over the flat
  * `[src0, tgt0, src1, tgt1, …]` link buffer — no comparison sort and no
  * per-link allocation (the only allocations are the CSR arrays plus one
  * point-sized cursor array).
@@ -1420,9 +1428,9 @@ declare function buildAdjacency(links: Uint32Array, pointCount: number): Adjacen
  */
 declare function neighborsOf(adj: Adjacency, index: number): Uint32Array;
 /**
- * CSR INCIDENCE: point → incident EDGE SLOTS (F10-02). The plain Adjacency
+ * CSR INCIDENCE: point → incident EDGE SLOTS. The plain Adjacency
  * stores neighbor points, which cannot drive incident-edge dirtying — the
- * §9.1 delta cascade needs the edge slots themselves. Same two counting
+ * delta cascade needs the edge slots themselves. Same two counting
  * passes and the same conventions: undirected (each edge listed under both
  * endpoints), parallel edges repeat, and a self-loop lists its edge slot
  * twice under its point — consumers' per-edge operations are idempotent, so
@@ -1437,26 +1445,26 @@ interface Incidence {
 }
 
 /**
- * §13/§15 CPU link-pick fallback: a uniform grid over ALL links in SPACE
+ * CPU link-pick fallback: a uniform grid over ALL links in SPACE
  * coordinates (cell ≈ median link length), used when the engine lacks native
  * `linkAt` (`capabilities.linkPicking === false`). Backs
- * `onEdgeClick`/`onEdgeHover` via the §7.4 index→edge mapping.
+ * `onEdgeClick`/`onEdgeHover` via the index→edge mapping.
  *
  * Coordinate contract: everything here is SPACE coordinates. Callers invert
  * the affine `Viewport` (space = (screen − center)/zoom + [x, y]) and pass a
  * space-unit tolerance (`tolerancePx / zoom`).
  *
  * Invalidation contract (normative — wave 2 enforces arming):
- * - The grid indexes a POSITION SNAPSHOT (the §7.1 `posBuf` CPU mirror as of
- *   the build call). It NEVER observes live simulation positions: while the
- *   simulation is hot (alpha above threshold) or an animated `setLayout()`
- *   transition runs, picking is DISARMED by the caller; on settle one
- *   per-event `getPositions` refreshes the mirror and the grid is rebuilt.
+ * - The grid indexes a POSITION SNAPSHOT (the `posBuf` CPU mirror as of
+ * the build call). It NEVER observes live simulation positions: while the
+ * simulation is hot (alpha above threshold) or an animated `setLayout`
+ * transition runs, picking is DISARMED by the caller; on settle one
+ * per-event `getPositions` refreshes the mirror and the grid is rebuilt.
  * - Rebuild ONLY on structural change (link buffer changed) or position
- *   sync. The grid is invariant under camera moves and visibility-mask
- *   changes: the §9.1 mask is applied per candidate at QUERY time via the
- *   optional `visible` callback (pure pass-through until S9 wires the real
- *   mask through it).
+ * sync. The grid is invariant under camera moves and visibility-mask
+ * changes: the mask is applied per candidate at QUERY time via the
+ * optional `visible` callback (pure pass-through until mask wiring supplies the real
+ * mask through it).
  *
  * Build uses two counting-sort passes into CSR grid arrays (`cellOffsets`,
  * `cellLinkIds`). Each segment is inserted with a supercover grid traversal,
@@ -1464,11 +1472,11 @@ interface Incidence {
  * every cell in its O(cols * rows) axis-aligned bounding box. There is no
  * comparison sort or per-link allocation beyond the CSR arrays (plus
  * O(cells) cursor and O(links) query stamps). Links with a non-finite endpoint
- * (NaN-tombstoned points, §13) are excluded and can never be returned. A hard
+ * (NaN-tombstoned points) are excluded and can never be returned. A hard
  * CSR-entry cap deterministically degrades pathological builds to exact O(L)
  * query scans with no cell-link payload.
  */
-/** §9.1 visibility mask applied per candidate at query time. */
+/** visibility mask applied per candidate at query time. */
 type LinkVisibilityMask = (linkIndex: number) => boolean;
 /**
  * Read-only view of the built grid (diagnostics/tests). The typed arrays are
@@ -1514,8 +1522,8 @@ declare class LinkPickIndex {
      */
     build(positions: Float32Array, links: Uint32Array): void;
     /**
-     * Incremental build: yields whenever `now() − sliceStart ≥ budgetMs` so a
-     * scheduler can spread the work across idle frames (§17 long-task budget).
+     * Incremental build: yields whenever `now − sliceStart ≥ budgetMs` so a
+     * scheduler can spread the work across idle frames.
      * Pure generator — no rAF/timers here; the caller owns scheduling.
      *
      * The previous grid stays armed and queryable until the new one commits on
@@ -1528,7 +1536,7 @@ declare class LinkPickIndex {
      * Nearest link within `tolerance` (space units) of the space point
      * `(x, y)`, or null. Scans the candidate cells covering the tolerance
      * disc's bounding box (typically the 3×3 neighborhood; more when the
-     * tolerance exceeds the cell size), applies the optional §9.1 visibility
+     * tolerance exceeds the cell size), applies the optional visibility
      * mask per candidate, then runs the exact point→segment distance test.
      * Nearest wins; exact-distance ties break toward the LOWER link index.
      * Returns null while unbuilt/invalidated (picking disarmed).
@@ -1537,45 +1545,45 @@ declare class LinkPickIndex {
 }
 
 /**
- * §13/§15 edge-picking facade (S6-T07).
+ * Edge-picking facade.
  *
  * The core commits to ONE route per mount session, read from
  * `engine.capabilities.linkPicking` at engine-ready time — never method
  * sniffing, and never re-evaluated (a capability record mutated after ready
  * changes nothing):
  *
- *  - 'native':   the adapter delivers `onLinkClick`/`onLinkHover` host events
- *                itself; the facade is inert (arm/disarm/queries no-op and
- *                `pickLinkAt` returns null) and the instance maps link indices
- *                to typed edges straight off the host events.
- *  - 'fallback': the instance samples the pointer on the shared §15 throttle
- *                cadence and resolves hits through a `LinkPickIndex` uniform
- *                grid that is armed ONLY while the simulation is settled.
- *
- * Arming protocol (fallback route; §13):
- *  - `arm(positions, links)` runs on simulation settle (fed by one per-event
- *    `getPositions` readback) and on structural commits that do NOT restart
- *    the simulation (fixed layout). The grid builds CHUNKED via
- *    `LinkPickIndex.buildChunked` under a per-slice time budget so large link
- *    sets never block (§17); small builds complete synchronously in the first
- *    slice. While an initial build is in flight queries return null; a
- *    position-sync REBUILD keeps answering from the previous grid until the
- *    new one commits.
- *  - `disarm()` runs on any commit that restarts the simulation: targets are
- *    moving and the position mirror is stale, so queries return null until
- *    the next settle re-arms.
- *  - Rebuilds happen ONLY on structural change or position sync — the grid is
- *    invariant under camera moves and mask changes (the §9.1 visibility mask
- *    is applied per candidate at query time; pass-through stub until S9).
- *
- * Tolerance (§13): a query converts screen px to space units via
+ * - 'native': the adapter delivers `onLinkClick`/`onLinkHover` host events
+ * itself; the facade is inert (arm/disarm/queries no-op and
+ * `pickLinkAt` returns null) and the instance maps link indices
+ * to typed edges straight off the host events.
+ * - 'fallback': the instance samples the pointer on the shared throttle
+ * cadence and resolves hits through a `LinkPickIndex` uniform
+ * grid that is armed ONLY while the simulation is settled.
+ *
+ * Arming protocol for the fallback route:
+ * - `arm(positions, links)` runs on simulation settle (fed by one per-event
+ * `getPositions` readback) and on structural commits that do NOT restart
+ * the simulation (fixed layout). The grid builds CHUNKED via
+ * `LinkPickIndex.buildChunked` under a per-slice time budget so large link
+ * sets never block; small builds complete synchronously in the first
+ * slice. While an initial build is in flight queries return null; a
+ * position-sync REBUILD keeps answering from the previous grid until the
+ * new one commits.
+ * - `disarm` runs on any commit that restarts the simulation: targets are
+ * moving and the position mirror is stale, so queries return null until
+ * the next settle re-arms.
+ * - Rebuilds happen ONLY on structural change or position sync — the grid is
+ * invariant under camera moves and mask changes (the visibility mask
+ * is applied per candidate at query time; initially a pass-through stub).
+ *
+ * Tolerance: a query converts screen px to space units via
  * `screenToSpace` of two points `EDGE_PICK_TOLERANCE_PX` apart, then uses
  * `max(4px, half the median link width)` scaled by that factor.
  */
 
 type EdgePickRoute = 'native' | 'fallback';
 /** Screen-space pick tolerance floor, and the probe distance used to measure
- * the screen→space scale (§13). */
+ * the screen→space scale. */
 declare const EDGE_PICK_TOLERANCE_PX = 4;
 /**
  * Median link width in px from a projected linkWidth buffer (deterministic
@@ -1588,9 +1596,9 @@ interface EdgePickingFacadeOptions {
     route: EdgePickRoute;
     /** Affine screen→space conversion; null = conversion unavailable. */
     screenToSpace: (p: readonly [number, number]) => readonly [number, number] | null;
-    /** Median link width in px for the tolerance floor; default () => 0. */
+    /** Median link width in px for the tolerance floor; default  => 0. */
     medianLinkWidthPx?: () => number;
-    /** §9.1 visibility mask pass-through stub (mutable via the setter). */
+    /** visibility mask pass-through stub (mutable via the setter). */
     linkVisible?: LinkVisibilityMask;
     /** Chunked-build slice budget in ms. */
     buildBudgetMs?: number;
@@ -1622,7 +1630,7 @@ declare class EdgePickingFacade {
     arm(positions: Float32Array, links: Uint32Array): void;
     /** Simulation went hot: drop the grid; queries null until the next settle. */
     disarm(): void;
-    /** §9.1 mask pass-through stub: applied per candidate at query time. */
+    /** mask pass-through stub: applied per candidate at query time. */
     setLinkVisibilityMask(mask: LinkVisibilityMask | null): void;
     /**
      * Nearest link index within tolerance of a SCREEN point, or null when: on
@@ -1646,8 +1654,8 @@ declare class EdgePickingFacade {
 type EdgePairCounters = Map<NodeId, Map<NodeId, number>>;
 
 /**
- * §7.5 revisioned ingestion — pure session/overlay bookkeeping plus the
- * instance-local acceptance queue (S8-T01..T07).
+ * revisioned ingestion — pure session/overlay bookkeeping plus the
+ * instance-local acceptance queue.
  *
  * Everything here is data-structure work: no store, no engine, no DOM. The
  * GraphInstance wires these helpers into its publication path (instance.ts).
@@ -1655,7 +1663,7 @@ type EdgePairCounters = Map<NodeId, Map<NodeId, number>>;
  * Ordering model: every admission takes a monotonically increasing ticket from
  * the instance's AcceptanceQueue. Overlay rows are stamped with their
  * admission ticket, and the merge folds base + overlays strictly in ticket
- * order — arrival at the queue IS the global admission order (§7.5).
+ * order — arrival at the queue IS the global admission order.
  */
 
 /** Byte backpressure budget default: 8 MiB of admitted-but-unflushed payload. */
@@ -1687,7 +1695,7 @@ interface RowTally {
     count: number;
     samples: string[];
 }
-/** Per-session staging tallies; surfaced as diagnostics ONLY at commit (§7.5). */
+/** Per-session staging tallies; surfaced as diagnostics ONLY at commit. */
 interface StagingTallies {
     invalidNodes: RowTally;
     duplicateNodes: RowTally;
@@ -1712,11 +1720,11 @@ interface SessionContribution<N = Record<string, unknown>, E = Record<string, un
     readonly edges: StampedEdge<E>[];
     readonly nodeIds: Set<NodeId>;
     readonly edgeIds: Set<string>;
-    /** Exact ordered endpoint tuple → next synthesized-parallel-edge k (§5). */
+    /** Exact ordered endpoint tuple → next synthesized-parallel-edge k. */
     readonly pairCounters: EdgePairCounters;
     /** Public prefix lengths: rows before these counts have been published
      * (progressive flush / commit); appends only grow the arrays, so a prefix
-     * is sufficient. Atomic sessions stay at 0 until commit (§7.5). */
+     * is sufficient. Atomic sessions stay at 0 until commit. */
     publicNodeCount: number;
     publicEdgeCount: number;
 }
@@ -1728,8 +1736,8 @@ interface StageResult {
 /**
  * Validate and stage one batch's rows into a session contribution.
  *
- * §5.1-equivalent row validation WITHOUT endpoint checks — edges may arrive
- * before nodes (§7.5): they occupy their eventual edge records here; endpoint
+ * Object-lane-equivalent row validation WITHOUT endpoint checks — edges may arrive
+ * before nodes: they occupy their eventual edge records here; endpoint
  * resolution happens at merge. Within a session, duplicate ids are
  * first-wins-dropped (tallied for commit diagnostics); cross-session
  * collisions are the merge's shadowing concern, not staging's.
@@ -1745,7 +1753,7 @@ interface MergeBase<N = Record<string, unknown>, E = Record<string, unknown>> {
     /** Endpoint-resolved base edges. */
     edges: readonly AcceptedEdge<E>[];
     /** Replace-session bases retain edge records whose endpoints were missing
-     * at commit; a later overlay node can still resolve them (§7.5). */
+     * at commit; a later overlay node can still resolve them. */
     pendingEdges: readonly StampedEdge<E>[];
     diagnostics: readonly GraphDiagnostic[];
 }
@@ -1761,7 +1769,7 @@ interface MergeResult<N = Record<string, unknown>, E = Record<string, unknown>>
     duplicateEdgeSamples: readonly string[];
     /** overlayId (or BASE_PENDING_KEY) → edges still awaiting an endpoint. The
      * pending-endpoint index: these occupy edge records but never enter the
-     * engine link buffer (§7.5). */
+     * engine link buffer. */
     pendingBySource: ReadonlyMap<string, number>;
     pendingEdgeCount: number;
 }
@@ -1776,15 +1784,15 @@ declare function baseFromContribution<N, E>(datasetKey: string, sourceRevision:
  * Merge the accepted base with every overlay contribution's PUBLIC rows.
  *
  * - Node collisions: earliest admission (ticket order; base first) wins.
- *   Later rows stay retained-but-shadowed in their contribution and are
- *   tallied for the single count-aggregated 'overlay-node-shadowed' info
- *   diagnostic (§7.5).
+ * Later rows stay retained-but-shadowed in their contribution and are
+ * tallied for the single count-aggregated 'overlay-node-shadowed' info
+ * diagnostic.
  * - Edge ids: first admission wins; later same-id records are dropped
- *   (tallied). An edge whose endpoints are not all present in the merged
- *   node set is pending — it occupies its record and the pending-endpoint
- *   accounting but is excluded from `accepted.edges` (and therefore from the
- *   engine link buffer). Endpoints arriving later resolve it on the next
- *   merge (same or different batch/overlay).
+ * (tallied). An edge whose endpoints are not all present in the merged
+ * node set is pending — it occupies its record and the pending-endpoint
+ * accounting but is excluded from `accepted.edges` (and therefore from the
+ * engine link buffer). Endpoints arriving later resolve it on the next
+ * merge (same or different batch/overlay).
  *
  * Deterministic: output depends only on the base and the stamped rows.
  */
@@ -1793,20 +1801,20 @@ declare function mergeModel<N, E>(base: MergeBase<N, E>, overlays: readonly Sess
 declare function mergeDiagnostics(merge: MergeResult<unknown, unknown>): GraphDiagnostic[];
 /**
  * Commit-time diagnostics for one session: staging tallies plus the dangling
- * (still-pending-endpoint) count — emitted ONLY at session commit (§7.5).
+ * (still-pending-endpoint) count — emitted ONLY at session commit.
  */
 declare function sessionCommitDiagnostics(tallies: StagingTallies, danglingCount: number, danglingSamples?: readonly string[]): GraphDiagnostic[];
 
 /**
- * §9.2 hard subgraph scope — pure resolution over the accepted base.
+ * hard subgraph scope — pure resolution over the accepted base.
  *
  * `resolveScope` turns a `SubgraphSpec` into the exact node/edge subset the
  * reconciler should be fed: seeds validated against the accepted base
  * (unknown ids dropped, duplicates collapsed), optional `hops` expansion via
- * BFS over the §7.1 CSR adjacency of the ACCEPTED BASE (not the scene — the
- * default expansion service walks this same index, §9.2), and edges cascaded
- * through `cascadeEdges`, the single §9 edge-survival primitive (an edge
- * survives iff BOTH endpoints survive) that S9's soft masks reuse.
+ * BFS over the CSR adjacency of the ACCEPTED BASE (not the scene — the
+ * default expansion service walks this same index), and edges cascaded
+ * through `cascadeEdges`, the single edge-survival primitive (an edge
+ * survives iff BOTH endpoints survive) that soft masks reuse.
  *
  * Everything here is synchronous and engine-free. The async
  * `ExpansionService` seam (./services) exists for `expandNode`; `hops`
@@ -1814,21 +1822,21 @@ declare function sessionCommitDiagnostics(tallies: StagingTallies, danglingCount
  */
 
 /**
- * THE edge-cascade primitive (§9): an edge survives iff BOTH of its
+ * THE edge-cascade primitive: an edge survives iff BOTH of its
  * endpoints survive. O(E); the only allocation is the output array, which
  * holds references to the input edge objects (never copies).
  *
- * Exported for reuse by §9.1 soft masks (S9) and any other subset producer.
+ * Exported for reuse by soft masks and any other subset producer.
  */
 declare function cascadeEdges<E>(edges: readonly AcceptedEdge<E>[], survives: (id: NodeId) => boolean): AcceptedEdge<E>[];
 /**
- * Builds the §7.1 CSR adjacency of an accepted base: endpoints are positions
+ * Builds the CSR adjacency of an accepted base: endpoints are positions
  * in `accepted.nodes` (accepted-base order). Every accepted edge has resolved
- * endpoints by contract (§5.1 drops dangling edges), so this cannot throw on
+ * endpoints by contract, so this cannot throw on
  * a well-formed `AcceptedGraph`.
  */
 declare function buildAcceptedAdjacency(accepted: AcceptedGraph<unknown, unknown>): Adjacency;
-/** Output of `resolveScope`: the exact subset to feed the reconciler (§9.2). */
+/** Output of `resolveScope`: the exact subset to feed the reconciler. */
 interface ResolvedScope<N = Record<string, unknown>, E = Record<string, unknown>> {
     /** Surviving node ids (seeds + hop expansion), membership-query form. */
     nodeIds: ReadonlySet<NodeId>;
@@ -1838,31 +1846,31 @@ interface ResolvedScope<N = Record<string, unknown>, E = Record<string, unknown>
     edges: readonly AcceptedEdge<E>[];
 }
 /**
- * Resolves a hard-scope spec against the accepted base (§9.2).
+ * Resolves a hard-scope spec against the accepted base.
  *
  * - `spec.seedIds` are validated against `accepted.nodeIndex`: ids unknown to
- *   the accepted base are dropped, duplicates collapse to one seed.
+ * the accepted base are dropped, duplicates collapse to one seed.
  * - `spec.hops` (default 0; negative/non-finite values clamp to 0, fractions
- *   floor) expands the survivor set by BFS over the accepted-base adjacency.
- *   This is the synchronous local path — the §9.2 default `ExpansionService`
- *   walks the same index for `expandNode`.
+ * floor) expands the survivor set by BFS over the accepted-base adjacency.
+ * This is the synchronous local path — the default `ExpansionService`
+ * walks the same index for `expandNode`.
  * - `adjacency` may be a caller-cached `buildAcceptedAdjacency(accepted)`
- *   result; pass `null` to have one built on demand (only when `hops > 0`
- *   and there are surviving seeds — hop-0 resolution never builds it).
+ * result; pass `null` to have one built on demand (only when `hops > 0`
+ * and there are surviving seeds — hop-0 resolution never builds it).
  * - Output preserves accepted-base order for both nodes and edges; edges are
- *   cascaded through {@link cascadeEdges}.
+ * cascaded through {@link cascadeEdges}.
  */
 declare function resolveScope<N, E>(accepted: AcceptedGraph<N, E>, spec: SubgraphSpec, adjacency: Adjacency | null): ResolvedScope<N, E>;
 
 /**
- * §9.2 revision-aware services — pure sequencing/admission/caching helpers
+ * revision-aware services — pure sequencing/admission/caching helpers
  * plus the built-in local expansion service.
  *
  * The correctness gate is `admitServiceResult`: a result is admitted only if
  * every revision dimension the service DECLARED is unchanged since the call
  * was issued; undeclared dimensions never invalidate (so e.g. the local
  * expansion service, declaring only 'source', survives unrelated model/scope
- * advances from other overlay publications). Abort is an optimization —
+ * advances from other overlay publications). Abort is an optimization
  * admission is the gate.
  *
  * Cache keys include service identity, canonical-JSON request parameters,
@@ -1872,7 +1880,7 @@ declare function resolveScope<N, E>(accepted: AcceptedGraph<N, E>, spec: Subgrap
  * these primitives to its acceptance queue.
  */
 
-/** Current value of each §9.2 revision dimension (a Revisions subset). */
+/** Current value of each revision dimension (a Revisions subset). */
 interface RevisionSnapshot {
     source: number | string | null;
     model: number;
@@ -1896,13 +1904,13 @@ interface RequestContextHandle {
     abort(reason?: unknown): void;
 }
 /**
- * Builds the `RequestContext` a service call receives (§9.2): dataset,
+ * Builds the `RequestContext` a service call receives: dataset,
  * the three revision dimensions at issue time, a request id, and a
  * cancellation signal owned by the returned controller.
  */
 declare function createRequestContext(args: CreateRequestContextArgs): RequestContextHandle;
 interface AdmitServiceResultArgs {
-    /** The service's `revisionDependencies` (§9.2). */
+    /** The service's `revisionDependencies`. */
     declared: readonly RevisionDimension[];
     /** Revision values when the request was issued. */
     at: RevisionSnapshot;
@@ -1910,7 +1918,7 @@ interface AdmitServiceResultArgs {
     now: RevisionSnapshot;
 }
 /**
- * §9.2 stale-result rule: admit a service result iff EVERY declared revision
+ * stale-result rule: admit a service result iff EVERY declared revision
  * dimension is unchanged between issue and admission. Undeclared dimensions
  * never invalidate. Declaring nothing means the result is admissible under
  * any drift; declaring all three restores strict point-in-model semantics.
@@ -1921,13 +1929,13 @@ interface ServiceCacheKeyArgs {
     /** Request parameters (JSON-shaped); key order is canonicalized away. */
     params: unknown;
     datasetKey: string;
-    /** The service's declared revision dependencies (§9.2). */
+    /** The service's declared revision dependencies. */
     declared: readonly RevisionDimension[];
     /** Current revision values; only declared dimensions enter the key. */
     revisions: RevisionSnapshot;
 }
 /**
- * §9.2 cache-key rule: service identity + canonical-JSON params +
+ * cache-key rule: service identity + canonical-JSON params +
  * `datasetKey` + EXACTLY the declared revision dimensions' current values.
  * Declaration-list order and params key order do not affect the key;
  * undeclared revision drift never changes it.
@@ -1936,11 +1944,11 @@ declare function serviceCacheKey(args: ServiceCacheKeyArgs): string;
 /** Accepted-base view the local service walks (thunked for lazy wiring). */
 interface LocalExpansionBase<N = Record<string, unknown>, E = Record<string, unknown>> {
     accepted: AcceptedGraph<N, E>;
-    /** The §7.1 CSR adjacency of `accepted` (see buildAcceptedAdjacency). */
+    /** The CSR adjacency of `accepted` (see buildAcceptedAdjacency). */
     adjacency: Adjacency;
 }
 /**
- * The built-in §9.2 expansion service: walks the core's accepted-base
+ * The built-in expansion service: walks the core's accepted-base
  * adjacency — INCLUDING currently out-of-scope nodes (it reads the base, not
  * the scene) — with zero config and zero network. Declares
  * `revisionDependencies: ['source']`, so unrelated model/scope advances
@@ -1954,7 +1962,7 @@ interface LocalExpansionBase<N = Record<string, unknown>, E = Record<string, unk
  * admission gate is authoritative).
  *
  * The response is the CLOSED N-hop neighborhood (seeds included, plus every
- * edge between returned nodes); per §9.2 the overlay merger dedupes rows
+ * edge between returned nodes); the overlay merger dedupes rows
  * that already exist, so returning already-known seeds is correct.
  */
 declare function createLocalExpansionService<N = Record<string, unknown>, E = Record<string, unknown>>(getBase: () => LocalExpansionBase<N, E>): ExpansionService<N, E>;
@@ -1967,7 +1975,7 @@ type RegisterExpansionResult = {
     onto: string;
 };
 /**
- * Pure in-flight-expansion ledger (§9.2): within one valid scope revision a
+ * Pure in-flight-expansion ledger: within one valid scope revision a
  * second `expandNode(id)` while one is in flight coalesces into the pending
  * call; expansions of DISTINCT ids run (and complete) concurrently and
  * independently. `retractExpansion(id)` uses `abort(id)` to drop that id's
@@ -2005,14 +2013,15 @@ declare class PendingExpansions {
 }
 
 /**
- * §16.14 history command-stack kernel (S9-T20; pulled forward from M7).
+ * history command-stack kernel.
  *
  * v0.7 implements the KERNEL only: value-diff commands, transactions,
  * coalescing, and a bounded stack. The kernel never touches stores — it is a
- * pure application seam: `undo()`/`redo()` return the command list to apply
+ * pure application seam: `undo`/`redo` return the command list to apply
  * (already inverted, in application order) and move the cursor; the instance
- * (wired in S15) applies commands to its slices and publishes.
- * Ownership-mode acknowledgement walks and view-state integration are S15.
+ * applies commands to its slices and publishes.
+ * Ownership-mode acknowledgement walks and view-state integration remain
+ * instance-level concerns.
  *
  * Commands are `{ slice, before, after }` value diffs — never closures — so
  * they are serializable and invert by swapping. The kernel freezes and stores
@@ -2032,7 +2041,7 @@ interface HistoryDepths {
     readonly redoDepth: number;
 }
 interface HistoryKernelOptions {
-    /** Stack bound; oldest entry evicted past it (§16.14; default 50). */
+    /** Stack bound; oldest entry evicted past it. */
     limit?: number;
     /** `false` = the `history: false` prop: everything is a no-op, depths stay 0. */
     enabled?: boolean;
@@ -2050,7 +2059,7 @@ declare class HistoryKernel {
     private readonly debug;
     private readonly undoStack;
     private readonly redoStack;
-    /** Nested begin() joins the outer transaction (depth-counted). */
+    /** Nested begin joins the outer transaction (depth-counted). */
     private txDepth;
     private txCommands;
     private txLabel;
@@ -2080,7 +2089,7 @@ declare class HistoryKernel {
      * transaction. The kernel freezes and stores what it is given.
      */
     record(slice: string, before: unknown, after: unknown): void;
-    /** Close a transaction; the outermost end() pushes one stack entry. */
+    /** Close a transaction; the outermost end pushes one stack entry. */
     end(): void;
     /**
      * Move the cursor back one entry and return its commands, already inverted
@@ -2110,28 +2119,28 @@ declare class HistoryKernel {
 }
 
 /**
- * §9.1 soft filtering (S9-T01) — pure, engine-free expr evaluation,
+ * soft filtering — pure, engine-free expr evaluation,
  * validation, compilation, and canonical keying. The instance feeds compiled
  * filters into the SoftMask kernel (./mask); nothing here touches the store.
  *
- * Semantics (orbit-spec.md §9.1):
+ * Semantics:
  * - `field` addresses `attrs[field]`; the literal field 'id' addresses the
- *   entity id (it wins even when `attrs.id` exists).
- * - The serializable expr path NEVER throws: junk shapes and §8-hygiene
- *   failures (non-numeric / non-finite values under 'range') simply fail the
- *   item. `validateFilterExpr` is the reporting channel — the instance turns
- *   its findings into validation errors at applyHostUpdate.
+ * entity id (it wins even when `attrs.id` exists).
+ * - The serializable expr path NEVER throws: junk shapes and numeric-hygiene
+ * failures (non-numeric / non-finite values under 'range') simply fail the
+ * item. `validateFilterExpr` is the reporting channel — the instance turns
+ * its findings into validation errors at applyHostUpdate.
  * - eq/neq/in compare numbers with Object.is semantics EXCEPT that NaN is
- *   never equal to anything (so ±0 are distinct and NaN ≠ NaN); everything
- *   else compares with plain ===. No coercion, ever ('5' never equals 5).
+ * never equal to anything (so ±0 are distinct and NaN ≠ NaN); everything
+ * else compares with plain ===. No coercion, ever ('5' never equals 5).
  * - Function predicates are black boxes: throws are caught and aggregated
- *   into ONE {count, samples} result the caller converts to a single
- *   'filter-error' diagnostic (§5.1 batching — O(categories), never O(bad
- *   rows)). A throwing predicate FAILS OPEN: the item stays visible, so a
- *   buggy predicate can never blank the graph.
+ * into ONE {count, samples} result the caller converts to a single
+ * 'filter-error' diagnostic (batching — O(categories), never O(bad
+ * rows)). A throwing predicate FAILS OPEN: the item stays visible, so a
+ * buggy predicate can never blank the graph.
  * - Structural specs compare by canonical key (`canonicalFilterKey`) so
- *   identity churn with equal structure never re-evaluates; function
- *   predicates key by reference identity via a WeakMap-issued token.
+ * identity churn with equal structure never re-evaluates; function
+ * predicates key by reference identity via a WeakMap-issued token.
  */
 
 /**
@@ -2141,7 +2150,7 @@ declare class HistoryKernel {
 declare function resolveFilterField(item: GraphNode<unknown> | AcceptedEdge<unknown>, field: string): unknown;
 /**
  * Evaluates one expr for one item via a field resolver. NEVER throws:
- * malformed shapes and §8-hygiene failures fail the item (return false);
+ * malformed shapes and numeric-hygiene failures fail the item (return false);
  * a malformed operand under 'not' also fails (junk never passes by double
  * negation). `range` requires a finite number value; missing bounds are
  * unbounded; includeMin/includeMax default true. `is-null` matches null OR
@@ -2151,7 +2160,7 @@ declare function evaluateFilterExpr(expr: FilterExpr, resolve: (field: string) =
 /**
  * Structural checker for serializable exprs: unknown ops and malformed
  * shapes are reported as `$`-rooted path strings ([] = valid). The instance
- * converts findings into validation errors at applyHostUpdate (§9.1) —
+ * converts findings into validation errors at applyHostUpdate
  * evaluation itself never throws on the same junk, it just fails the item.
  */
 declare function validateFilterExpr(expr: FilterExpr): string[];
@@ -2178,7 +2187,7 @@ declare function compileEdgeFilter<N = Record<string, unknown>, E = Record<strin
  * Canonical structural key for a FilterSpec or FilterExpr: object keys are
  * sorted, arrays preserve order, undefined-valued keys are omitted, and
  * function predicates map to a unique reference-identity token. Two inputs
- * with equal keys are §9.1-equivalent — the instance skips re-evaluation
+ * with equal keys are semantically equivalent — the instance skips re-evaluation
  * when the key of an incoming filter matches the active one (identity churn
  * with equal structure never re-evaluates; swapping a function reference
  * always does).
@@ -2186,14 +2195,14 @@ declare function compileEdgeFilter<N = Record<string, unknown>, E = Record<strin
 declare function canonicalFilterKey(specOrExpr: unknown): string;
 
 /**
- * §9.1 soft-mask kernel (S9-T02/T03) — failure COUNTERS, never Sets and
+ * soft-mask kernel — failure COUNTERS, never Sets and
  * never per-source bit positions (so there is no 32-dimension cap).
  *
  * The mask owns four Uint16 counter lanes: hideFailures and dimFailures for
  * nodes AND edges. Every acquired {@link MaskSource} contributes +1 to a
  * lane counter for each slot it currently fails and -1 when that slot
  * re-enters. A slot is visible iff hideFailures === 0 and dimmed iff visible
- * AND dimFailures > 0 (spec §9.1 mask mechanics).
+ * AND dimFailures > 0.
  *
  * Delta discipline: each source keeps its previous failing membership as
  * per-source Uint8 flag columns plus a dense slot list, so replacing a
@@ -2203,9 +2212,9 @@ declare function canonicalFilterKey(specOrExpr: unknown): string;
  * compares against the state at the previous drain, so a fail-then-restore
  * inside one drain period nets to no emission.
  *
- * {@link SoftMask.applyNodeCascadeToEdges} implements §9's SINGLE edge-
+ * {@link SoftMask.applyNodeCascadeToEdges} implements SINGLE edge-
  * survival rule over the mask lane: an edge hide-fails iff EITHER endpoint
- * hide-fails (equivalently: survives iff BOTH endpoints survive —
+ * hide-fails (equivalently: survives iff BOTH endpoints survive
  * scope.ts `cascadeEdges` is the hard-scope variant of the same rule). It is
  * fed through one dedicated internal cascade source from the node hide lane:
  * O(E) recompute per call, but only edges whose state changed produce
@@ -2213,12 +2222,12 @@ declare function canonicalFilterKey(specOrExpr: unknown): string;
  *
  * Overflow guard: increments clamp at 0xFFFF and latch a one-time
  * {@link SoftMask.overflowed} flag the caller reports (an implementation may
- * widen to Uint32 without changing semantics, §9.1). Debug builds assert
- * balanced increments/decrements whenever a clear()/release() leaves zero
+ * widen to Uint32 without changing semantics). Debug builds assert
+ * balanced increments/decrements whenever a clear/release leaves zero
  * held memberships.
  */
 
-/** Default muted alpha for dimmed entities (§9.1 'dim' mode). */
+/** Default muted alpha for dimmed entities. */
 declare const DIM_ALPHA_DEFAULT = 0.15;
 /**
  * A handle contributing failure memberships to the mask. Setting a lane
@@ -2231,7 +2240,7 @@ interface MaskSource {
     setNodeFailures(hideIdx: Iterable<number> | null, dimIdx?: Iterable<number> | null): void;
     setEdgeFailures(hideIdx: Iterable<number> | null, dimIdx?: Iterable<number> | null): void;
     /**
-     * O(Δ) delta form of the HIDE lane (F10-02): adds/removes individual slots
+     * O(Δ) delta form of the HIDE lane: adds/removes individual slots
      * from this source's membership without replaying the full set. Freely
      * composable with the replace form — a later setNodeFailures re-baselines.
      * `crossings`, when supplied, receives the slots whose hide counter
@@ -2242,8 +2251,8 @@ interface MaskSource {
     updateEdgeFailures(addHide: ArrayLike<number> | null, removeHide: ArrayLike<number> | null): void;
     /** Empties all four lane memberships (the source stays usable). */
     clear(): void;
-    /** clear() + permanently retires the handle (further set/clear throws;
-     * release() itself is idempotent). */
+    /** clear + permanently retires the handle (further set/clear throws;
+     * release itself is idempotent). */
     release(): void;
 }
 /** Per-CALL zero-crossings reported by the delta ops (reused, callee-cleared). */
@@ -2253,7 +2262,7 @@ interface MaskCrossings {
     /** Slots whose hide counter went nonzero → 0 in this call. */
     becameClear: number[];
 }
-/** §17 O(Δ) operation counters (see resetStats/stats on SoftMask). */
+/** O(Δ) operation counters (see resetStats/stats on SoftMask). */
 interface MaskStats {
     /** Slots visited by delta membership ops (add + remove attempts). */
     slotsVisited: number;
@@ -2264,7 +2273,7 @@ interface MaskStats {
 }
 /**
  * One drain payload. The four index arrays are REUSED across drains — copy
- * before the next drainDirty() call if you need to keep them.
+ * before the next drainDirty call if you need to keep them.
  */
 interface MaskDrain {
     /** Node slots whose hide-visibility (hideFailures 0 ↔ nonzero) flipped
@@ -2289,18 +2298,18 @@ declare class SoftMask {
     private readonly edgeHideLane;
     private readonly edgeDimLane;
     private readonly sources;
-    /** Dedicated internal source implementing the §9 node→edge cascade. */
+    /** Dedicated internal source implementing the node→edge cascade. */
     private cascadeSource;
     private overflowedFlag;
     /** Total memberships currently held across all sources and lanes. */
     private totalHeld;
-    /** §17 O(Δ) op counters (F10-02 gate instrumentation). */
+    /** O(Δ) op counters. */
     private readonly statsBox;
     constructor(nodeCapacity: number, edgeCapacity: number);
     get nodeCapacity(): number;
     get edgeCapacity(): number;
     /** One-time latch: some counter hit 0xFFFF and an increment was dropped.
-     * Counts may drift afterwards; the caller reports it (§9.1 overflow guard). */
+     * Counts may drift afterwards; the caller reports it. */
     get overflowed(): boolean;
     get nodeHideFailures(): Uint16Array;
     get nodeDimFailures(): Uint16Array;
@@ -2308,18 +2317,18 @@ declare class SoftMask {
     get edgeDimFailures(): Uint16Array;
     /**
      * Grows capacities for structure changes (existing slot state is
-     * preserved; new slots start fully visible). Capacities never shrink —
+     * preserved; new slots start fully visible). Capacities never shrink
      * a smaller value is a no-op for that dimension.
      */
     grow(nodeCapacity: number, edgeCapacity: number): void;
-    /** Registers a new failure source. No cap on source count (§9.1). */
+    /** Registers a new failure source. No cap on source count. */
     acquire(name: string): MaskSource;
     /**
-     * §9 edge cascade over the mask lane: recomputes, from the CURRENT node
+     * edge cascade over the mask lane: recomputes, from the CURRENT node
      * hide lane, the set of edges with at least one hidden endpoint, and feeds
      * it to the dedicated internal cascade source (edge hide lane only).
-     * `links` is the flat `[src0, tgt0, src1, tgt1, …]` node-slot pair buffer
-     * (§7.1 CSR input shape); edge slot i has endpoints at links[2i]/[2i+1].
+     * `links` is the flat `[src0, tgt0, src1, tgt1, …]` node-slot pair buffer;
+     * edge slot i has endpoints at links[2i]/[2i+1].
      * O(E) scan per call — typically once per drain — but only edges whose
      * cascade state changed produce counter deltas (and thus dirty entries).
      * Edges beyond `links.length / 2` are treated as having no hidden
@@ -2327,7 +2336,7 @@ declare class SoftMask {
      */
     applyNodeCascadeToEdges(links: Uint32Array): void;
     /**
-     * O(incident-edges) delta form of the §9.1 cascade (F10-02): for each node
+     * O(incident-edges) delta form of the cascade: for each node
      * whose HIDE visibility crossed zero, recompute only its incident edges'
      * cascade state from the CURRENT node counters and apply the delta through
      * the same internal cascade source the full form uses — the two compose
@@ -2343,10 +2352,10 @@ declare class SoftMask {
      * drain). The returned index arrays are reused by the next drain.
      */
     drainDirty(): MaskDrain;
-    /** §17 telemetry: estimated bytes of mask storage held (S13-T07):
+    /** telemetry: estimated bytes of mask storage held:
      * four counter lanes (+pending trackers) and per-source flag columns. */
     estimatedBytes(): number;
-    /** §17 O(Δ) op counters (live object — snapshot before comparing). */
+    /** O(Δ) op counters (live object — snapshot before comparing). */
     get stats(): Readonly<MaskStats>;
     resetStats(): void;
     visibleNodeCount(): number;
@@ -2354,7 +2363,7 @@ declare class SoftMask {
     /** Visible iff hideFailures === 0 (out-of-range slots read not-visible). */
     isNodeVisible(index: number): boolean;
     isEdgeVisible(index: number): boolean;
-    /** Dimmed iff visible AND dimFailures > 0 (§9.1). */
+    /** Dimmed iff visible AND dimFailures > 0. */
     isNodeDimmed(index: number): boolean;
     isEdgeDimmed(index: number): boolean;
     /** 1 (fully visible) | dimAlpha (dimmed) | 0 (hidden). */
@@ -2368,7 +2377,7 @@ declare class SoftMask {
      */
     private applyMembership;
     /**
-     * O(Δ) delta ops on one lane membership (F10-02). Adds and removes are
+     * O(Δ) delta ops on one lane membership. Adds and removes are
      * idempotent per slot (adding a member / removing a non-member is a
      * no-op); removed slots leave HOLES in `list` (compacted past 50%), so
      * replace/clear passes must honor the bit0 guard above. `crossings`, when
@@ -2383,65 +2392,65 @@ declare class SoftMask {
     private drainLane;
     private clearSource;
     /** Debug balanced-increment assert: whenever no source holds any
-     * membership, every counter must read zero (skipped once overflowed —
+     * membership, every counter must read zero (skipped once overflowed
      * clamped increments legitimately drift the books). */
     private assertBalancedIfIdle;
 }
 
 /**
- * §16.6 crossfilter — typed-column engine (v0.7 node-dimension subset).
+ * crossfilter — typed-column engine (v0.7 node-dimension subset).
  *
  * `TypedColumnCrossfilter` is the columnar backend the instance wraps into the
  * public `CrossfilterSession`. Design (crossfilter.js lineage):
  *
- * - **Parse once.** `build()` extracts every dimension exactly once into typed
- *   columns (numeric/temporal → `Float64Array` epoch-ms/values, categorical →
- *   dictionary codes). §8 hygiene: non-finite numerics, unparseable temporals,
- *   and non-string/non-finite categorical values are excluded from the
- *   dimension (tracked per dimension in `excludedRows`; the slot is marked
- *   invalid). Temporal parsing: numbers are epoch ms verbatim; strings go
- *   through `Date.parse` (ES2022 parses `'YYYY-MM-DD'` as UTC midnight);
- *   `Date` instances use `getTime()`.
+ * - **Parse once.** `build` extracts every dimension exactly once into typed
+ * columns (numeric/temporal → `Float64Array` epoch-ms/values, categorical →
+ * dictionary codes). hygiene: non-finite numerics, unparseable temporals,
+ * and non-string/non-finite categorical values are excluded from the
+ * dimension (tracked per dimension in `excludedRows`; the slot is marked
+ * invalid). Temporal parsing: numbers are epoch ms verbatim; strings go
+ * through `Date.parse` (ES2022 parses `'YYYY-MM-DD'` as UTC midnight);
+ * `Date` instances use `getTime`.
  * - **O(Δ) brushes.** Each range dimension keeps a one-time argsorted
- *   permutation. A brush move performs two binary searches and walks ONLY the
- *   symmetric difference between the old and new in-range windows; categorical
- *   brushes walk only the per-code slot lists whose excluded flag changed. The
- *   brush path never re-sorts. A per-slot, per-dimension pass flag plus a
- *   global per-slot failure counter make a row selection-visible iff it fails
- *   zero dimensions. Hygiene-excluded rows fail any non-null brush on that
- *   dimension (they cannot be in range / in a category) and pass a null brush.
+ * permutation. A brush move performs two binary searches and walks ONLY the
+ * symmetric difference between the old and new in-range windows; categorical
+ * brushes walk only the per-code slot lists whose excluded flag changed. The
+ * brush path never re-sorts. A per-slot, per-dimension pass flag plus a
+ * global per-slot failure counter make a row selection-visible iff it fails
+ * zero dimensions. Hygiene-excluded rows fail any non-null brush on that
+ * dimension (they cannot be in range / in a category) and pass a null brush.
  * - **Deltas out.** `setBrush` returns the slots whose overall visibility
- *   flipped (`hidden`/`shown`) for the instance's mask source.
- * - **Lazy dual layer.** `summarize()` returns immutable summaries whose
- *   `filtered` layer counts rows passing every OTHER dimension's brush plus an
- *   external node-mask predicate (`setExternalMask`). v0.7 recomputes a dirty
- *   dimension's filtered layer lazily per `summarize()` call — O(rows) per
- *   dirty summarize, documented and acceptable at this tier (§17 fixtures own
- *   the perf claims; the O(Δ) guarantee covers the brush/visibility path).
+ * flipped (`hidden`/`shown`) for the instance's mask source.
+ * - **Lazy dual layer.** `summarize` returns immutable summaries whose
+ * `filtered` layer counts rows passing every OTHER dimension's brush plus an
+ * external node-mask predicate (`setExternalMask`). v0.7 recomputes a dirty
+ * dimension's filtered layer lazily per `summarize` call — O(rows) per
+ * dirty summarize, documented and acceptable at this tier (fixtures own
+ * the perf claims; the O(Δ) guarantee covers the brush/visibility path).
  * - **Revisions & notify.** `selectionRevision` starts at 0 and advances
- *   exactly once per observable `setBrush` (a brush state change is observable
- *   via `getBrush` even when no row flips). v0.7 is synchronous, so
- *   latest-call-wins degenerates to "every call applies immediately in call
- *   order". Subscribers fire once per observable change after state is
- *   consistent; synchronous re-entrancy (a subscriber mutating the engine) is
- *   coalesced into one trailing notification pass. Model updates
- *   (`appendRows`/`replaceAll`) keep the current `selectionRevision` (§16.6)
- *   but do notify. External-mask changes notify (summaries changed) without
- *   advancing the selection revision.
+ * exactly once per observable `setBrush` (a brush state change is observable
+ * via `getBrush` even when no row flips). v0.7 is synchronous, so
+ * latest-call-wins degenerates to "every call applies immediately in call
+ * order". Subscribers fire once per observable change after state is
+ * consistent; synchronous re-entrancy (a subscriber mutating the engine) is
+ * coalesced into one trailing notification pass. Model updates
+ * (`appendRows`/`replaceAll`) keep the current `selectionRevision`
+ * but do notify. External-mask changes notify (summaries changed) without
+ * advancing the selection revision.
  * - **Incremental append.** `appendRows` extends columns/codes in place and
- *   merges the pre-sorted old permutation with the sorted new block
- *   (permutation merge — never a full re-argsort); bins extend incrementally
- *   unless the domain grew (then a re-bin, still sort-free). Brushes persist
- *   by key and are re-applied to the NEW slots only; the returned delta covers
- *   only new slots (`shown` = new passing, `hidden` = new failing).
- *   `replaceAll` rebuilds columns but preserves brushes by dimension key,
- *   re-applying them as one combined delta against an all-visible baseline of
- *   the new roster (`shown` is always empty). `replaceAll` clears the external
- *   mask (slot indices changed meaning); `appendRows` keeps it and treats new
- *   slots as passing until the instance re-supplies it.
+ * merges the pre-sorted old permutation with the sorted new block
+ * (permutation merge — never a full re-argsort); bins extend incrementally
+ * unless the domain grew (then a re-bin, still sort-free). Brushes persist
+ * by key and are re-applied to the NEW slots only; the returned delta covers
+ * only new slots (`shown` = new passing, `hidden` = new failing).
+ * `replaceAll` rebuilds columns but preserves brushes by dimension key,
+ * re-applying them as one combined delta against an all-visible baseline of
+ * the new roster (`shown` is always empty). `replaceAll` clears the external
+ * mask (slot indices changed meaning); `appendRows` keeps it and treats new
+ * slots as passing until the instance re-supplies it.
  */
 
-/** Default histogram bin count for numeric/temporal dimensions (§16.6). */
+/** Default histogram bin count for numeric/temporal dimensions. */
 declare const DEFAULT_BIN_COUNT = 24;
 /** Slots whose overall selection-visibility flipped in one operation. */
 interface BrushDelta {
@@ -2458,15 +2467,15 @@ interface CrossfilterStats {
     fullSorts: number;
     /** Permutation merges performed by appendRows. */
     permutationMerges: number;
-    /** Incremental filtered-layer bin adjustments (F10-02: O(Δ·D)). */
+    /** Incremental filtered-layer bin adjustments (O(Δ·D)). */
     binUpdates: number;
     /** Full O(rows) filtered-layer recomputes (materialization/oracle only). */
     filteredRecomputes: number;
 }
 declare class TypedColumnCrossfilter<N = Record<string, unknown>> {
-    /** Test instrumentation; see CrossfilterStats. Reset with resetStats(). */
+    /** Test instrumentation; see CrossfilterStats. Reset with resetStats. */
     readonly stats: CrossfilterStats;
-    /** Count of dims whose filtered layer is live-maintained (F10-02). */
+    /** Count of dims whose filtered layer is live-maintained. */
     private liveDims;
     private dims;
     private byKey;
@@ -2484,11 +2493,11 @@ declare class TypedColumnCrossfilter<N = Record<string, unknown>> {
     /** Monotonic from 0; advances exactly once per observable setBrush change. */
     get selectionRevision(): number;
     resetStats(): void;
-    /** §17 telemetry: estimated bytes of typed-column storage held (S13-T07).
+    /** telemetry: estimated bytes of typed-column storage held.
      * Documented components: per-dim value/permutation/bin/code/pass arrays,
      * the global failure counter, and the external mask. */
     estimatedBytes(): number;
-    /** F10-02 live-layer bookkeeping — the ONLY writer of `filteredLive`. */
+    /** live-layer bookkeeping — the ONLY writer of `filteredLive`. */
     private setFilteredLive;
     /**
      * (Re)initialize columns from scratch. Clears all brushes and the external
@@ -2510,19 +2519,19 @@ declare class TypedColumnCrossfilter<N = Record<string, unknown>> {
     setBrush(key: string, brush: BrushState): BrushDelta;
     /**
      * External node-mask predicate for the joint "filtered" second layer (the
-     * instance wires the §9.1 filter-prop node mask in). Affects summaries only,
-     * never selection visibility. Length must equal rowCount(). Notifies on
+     * instance wires the filter-prop node mask in). Affects summaries only,
+     * never selection visibility. Length must equal rowCount. Notifies on
      * observable change; does NOT advance selectionRevision.
      */
     setExternalMask(passSlots: Uint8Array | null): void;
     /**
-     * Immutable summary. The filtered layer is recomputed lazily when dirty —
+     * Immutable summary. The filtered layer is recomputed lazily when dirty
      * O(rows) per dirty summarize (v0.7 tier; see module doc). Returned objects
      * are frozen and never mutated by later operations.
      */
     summarize(key: string): DimensionSummary;
     /**
-     * Incrementally extend columns with new rows (S9-T09 subset): no full
+     * Incrementally extend columns with new rows: no full
      * rebuild, no full re-argsort — the pre-sorted old permutation merges with
      * the sorted new block. Brushes stay by key and are applied to the NEW slots
      * only; the returned delta covers only new slots. Keeps selectionRevision;
@@ -2551,16 +2560,16 @@ declare class TypedColumnCrossfilter<N = Record<string, unknown>> {
     private binIndex;
     private flip;
     /**
-     * F10-02 inline maintenance of LIVE filtered layers, dispatched from the
+     * inline maintenance of LIVE filtered layers, dispatched from the
      * one place that knows the failCount transition. `boundary` is the
      * other-failures picture at the interesting side of the flip (after for
      * shown, before for hidden):
-     *  - 0 → the slot crossed the FULLY-VISIBLE boundary: every other live
-     *    layer counts it (own layers ignore the own-dim brush, so the brushed
-     *    dim's layer is provably unchanged by its own flip);
-     *  - 1 → exactly one OTHER dim still fails the slot: only that dim's
-     *    what-if-I-cleared-mine layer flips;
-     *  - ≥2 → no layer can change.
+     * - 0 → the slot crossed the FULLY-VISIBLE boundary: every other live
+     * layer counts it (own layers ignore the own-dim brush, so the brushed
+     * dim's layer is provably unchanged by its own flip);
+     * - 1 → exactly one OTHER dim still fails the slot: only that dim's
+     * what-if-I-cleared-mine layer flips;
+     * - ≥2 → no layer can change.
      * External-mask-excluded and hygiene-invalid slots contribute nothing
      * either way and are skipped.
      */
@@ -2578,27 +2587,27 @@ declare class TypedColumnCrossfilter<N = Record<string, unknown>> {
 }
 
 /**
- * §11 scales & domains (S10-T01/T07) — canonical scale keying, default
+ * scales & domains — canonical scale keying, default
  * palettes, sRGB color interpolation, domain-state machinery, and stable
  * categorical assignment. Pure and engine-free; the instance/projection
  * layers consume these primitives when a styling channel carries a `Scale`.
  *
- * Semantics (orbit-spec.md §8/§11):
- * - Scales are plain descriptors compared by CANONICAL STRUCTURAL VALUE —
- *   equal inline literals produce equal keys and never reproject. A function
- *   `by` keys by reference identity (WeakMap token), never by source text.
+ * Semantics:
+ * - Scales are plain descriptors compared by CANONICAL STRUCTURAL VALUE
+ * equal inline literals produce equal keys and never reproject. A function
+ * `by` keys by reference identity (WeakMap token), never by source text.
  * - Domains default to the whole dataset revision and stay FROZEN across
- *   masking/brushing/isolation ('dataset' scope): the same metric value never
- *   changes visual meaning because a user brushed. 'hard-scope'/'visible' are
- *   explicit opt-ins that recompute when the caller's scope generation bumps;
- *   streaming 'expand' permits monotonic domain growth on recompute.
+ * masking/brushing/isolation ('dataset' scope): the same metric value never
+ * changes visual meaning because a user brushed. 'hard-scope'/'visible' are
+ * explicit opt-ins that recompute when the caller's scope generation bumps;
+ * streaming 'expand' permits monotonic domain growth on recompute.
  * - Explicit numeric domains always win verbatim (never computed, cached, or
- *   unioned).
+ * unioned).
  * - Categorical values declared in `domain` take their declared position;
- *   out-of-domain values take a stable fnv-1a hash slot — NEVER first-seen
- *   order, so arrival order can never recolor a category.
- * - §8 numeric hygiene: null/non-finite metric values resolve to `null`
- *   (caller falls back to the default style) and are excluded from domains.
+ * out-of-domain values take a stable fnv-1a hash slot — NEVER first-seen
+ * order, so arrival order can never recolor a category.
+ * - numeric hygiene: null/non-finite metric values resolve to `null`
+ * (caller falls back to the default style) and are excluded from domains.
  */
 
 type SequentialScale<T, N = Record<string, unknown>> = Extract<Scale<T, N>, {
@@ -2615,7 +2624,7 @@ type DivergingScale<T, N = Record<string, unknown>> = Extract<Scale<T, N>, {
  * order preserved, undefined-valued keys omitted, and a function `by` mapped
  * to a unique reference-identity token (same WeakMap approach — and canonical
  * grammar — as `canonicalFilterKey`). Two scales with equal keys are
- * §11-equivalent: equal inline literals MUST and DO produce equal keys, so
+ * structurally equivalent: equal inline literals MUST and DO produce equal keys, so
  * identity churn never reprojects; swapping a function reference always does.
  */
 declare function canonicalScaleKey<T, N>(scale: Scale<T, N>): string;
@@ -2634,7 +2643,7 @@ declare const DIVERGING_RANGE_DEFAULT: readonly [string, string, string];
 declare function interpolateColor(a: string, b: string, t: number): string;
 /**
  * Sequential color: maps `value` across `domain` onto the two-stop ramp.
- * Returns null (caller renders the default style, §8 hygiene) when the value
+ * Returns null (caller renders the default style, hygiene) when the value
  * is null/non-finite or the domain is null.
  */
 declare function sequentialColor<N = Record<string, unknown>>(scale: SequentialScale<string, N>, value: number | null, domain: readonly [number, number] | null): string | null;
@@ -2649,11 +2658,11 @@ declare function divergingColor<N = Record<string, unknown>>(scale: DivergingSca
  * Sequential size: linear map of `value` across `domain` onto [lo,hi],
  * clamped at the range endpoints. Degenerate domains yield the range
  * midpoint; null/non-finite values and null domains yield null (default
- * style — NaN is never handed to a size buffer, §8).
+ * style — NaN is never handed to a size buffer).
  */
 declare function sequentialSize(range: readonly [number, number], value: number | null, domain: readonly [number, number] | null): number | null;
 /**
- * [min,max] over the finite numbers in `values` (§8 hygiene: null and
+ * [min,max] over the finite numbers in `values` (hygiene: null and
  * non-finite entries are excluded), or null when nothing qualifies. A single
  * qualifying value yields a degenerate [v,v] domain.
  */
@@ -2663,7 +2672,7 @@ interface ResolveDomainArgs {
      * descriptor, so the key already discriminates by metric). Opaque here. */
     key: string;
     /** Explicit caller domain — returned VERBATIM; never computed, cached, or
-     * expand-unioned (§11: explicit always wins). */
+     * expand-unioned. */
     explicit?: readonly [number, number] | undefined;
     /** Defaults: scope 'dataset', streaming 'freeze-per-revision'. */
     policy?: DomainPolicy | undefined;
@@ -2673,7 +2682,7 @@ interface ResolveDomainArgs {
      * (bump = recompute). IGNORED under 'dataset' scope — masking/brushing
      * must never change what a color means. */
     scopeGeneration?: number | undefined;
-    /** Source lineage this resolve belongs to (F11-02: datasetKey + source
+    /** Source lineage this resolve belongs to (dataset key + source
      * revision). `streaming: 'expand'` unions only WITHIN one lineage — a
      * source replacement starts fresh instead of unioning dead extrema.
      * Callers that omit it keep the legacy always-union behavior. */
@@ -2683,7 +2692,7 @@ interface ResolveDomainArgs {
     compute: () => readonly [number, number] | null;
 }
 /**
- * Per-instance domain freezer keyed by canonical scale key (§11).
+ * Per-instance domain freezer keyed by canonical scale key.
  *
  * FREEZE-PER-REVISION: under scope 'dataset' the domain is computed ONCE per
  * {key, datasetRevision} — repeat resolves return the frozen value without
@@ -2722,24 +2731,24 @@ declare function categoricalIndex(domain: readonly string[] | undefined, palette
 declare function categoricalRows(domain: readonly string[] | undefined, seen: Iterable<string>): string[];
 
 /**
- * DEF2 capability-policy module (spec §13; plan S1-T08/S4-T05).
+ * capability-policy module.
  *
- * §13 (normative): for capabilities where the core owns a fallback path, the
+ * (normative): for capabilities where the core owns a fallback path, the
  * core selects native-vs-fallback ONCE at mount from the engine's declared
  * `capabilities` record — never by sniffing method presence — and unsupported
- * *requested* props degrade loudly (a §5.1 diagnostic), never as silent no-ops.
+ * *requested* props degrade loudly (a diagnostic), never as silent no-ops.
  *
  * This module is the single place those decisions are made:
- *  - {@link resolveEnginePolicy} turns the capability record + the host's
- *    requested features into one frozen {@link EnginePolicy} at mount.
- *  - {@link assertCapabilityMethodParity} is the mount-time dev-mode record
- *    vs. method-surface assertion, restricted to honestly checkable pairs.
- *  - {@link normalizeCommitForCapabilities} strips commit payload an engine
- *    declared it cannot honor, so incapable adapters never see it.
+ * - {@link resolveEnginePolicy} turns the capability record + the host's
+ * requested features into one frozen {@link EnginePolicy} at mount.
+ * - {@link assertCapabilityMethodParity} is the mount-time dev-mode record
+ * vs. method-surface assertion, restricted to honestly checkable pairs.
+ * - {@link normalizeCommitForCapabilities} strips commit payload an engine
+ * declared it cannot honor, so incapable adapters never see it.
  */
 
 /** One loud degradation: a feature the host requested that the mounted engine
- * does not declare. Feeds the §5.1 dev diagnostic at mount. */
+ * does not declare. Feeds the dev diagnostic at mount. */
 interface EnginePolicyDegradation {
     readonly feature: string;
     readonly reason: string;
@@ -2749,29 +2758,29 @@ interface EnginePolicyDegradation {
 interface RequestedEngineFeatures {
     edgeArrows?: boolean;
     images?: boolean;
-    /** §16.3 stage-4: a `clusters` spec is active this session. */
+    /** stage-4: a `clusters` spec is active this session. */
     clusters?: boolean;
 }
 /**
- * The frozen mount-time native-vs-fallback record (§13). Evaluated exactly
+ * The frozen mount-time native-vs-fallback record. Evaluated exactly
  * once per mount from `EngineCapabilities` and never revisited — capability
  * records are static declarations fixed at engine construction, so the policy
  * must not drift even if a caller mutates the input record afterwards.
  */
 interface EnginePolicy {
-    /** §16.12 arrowheads: engine-drawn, or the prop is inert (+ dev warning). */
+    /** arrowheads: engine-drawn, or the prop is inert (+ dev warning). */
     readonly edgeArrows: 'native' | 'inert';
-    /** §8 image sprites: atlas-backed, or the placeholder glyph with refs
+    /** image sprites: atlas-backed, or the placeholder glyph with refs
      * retained for a future compatible engine. */
     readonly images: 'native' | 'placeholder';
-    /** §13 link hover/click: engine events, or the core's CPU grid fallback. */
+    /** link hover/click: engine events, or the core's CPU grid fallback. */
     readonly linkPicking: 'native' | 'cpu-fallback';
-    /** §16.3 stage-4 cluster force: engine-applied, or inert (membership,
+    /** stage-4 cluster force: engine-applied, or inert (membership,
      * labels, and centroids are core-owned and unaffected). */
     readonly clusterForce: 'native' | 'inert';
     /** Channels eligible for ranged (partial) uploads; empty = full replaces. */
     readonly rangedChannels: ReadonlySet<EngineBufferChannel>;
-    /** §17 stop-at-rest: 'stops' when the engine declares idleFrames:'stops'.
+    /** stop-at-rest: 'stops' when the engine declares idleFrames:'stops'.
      * Observability only (telemetry/harness read it) — an idle-spinning engine
      * is a documented state, never a degradation entry: nothing was
      * host-REQUESTED, so there is nothing to warn about. */
@@ -2784,7 +2793,7 @@ interface EnginePolicy {
  * Resolve the mount-time engine policy from the declared capability record.
  *
  * Decisions come from `capabilities` ONLY — method sniffing is forbidden by
- * §13. The result is deep-frozen and holds a defensive copy of
+ * The result is deep-frozen and holds a defensive copy of
  * `rangeUpdates`, so mutating the input record afterwards changes nothing.
  * A degradation entry exists only for features the host actually requested
  * that the engine does not declare; unrequested gaps stay silent.
@@ -2795,25 +2804,25 @@ declare function resolveEnginePolicy(capabilities: EngineCapabilities, requested
  * with the engine's method surface? Returns a list of human-readable
  * mismatches (empty = consistent).
  *
- * Why so few checks? §13's illustrative parity assertion
+ * Why so few checks? An illustrative parity assertion
  * (`capabilities.linkPicking === (typeof engine.linkAt === 'function')`)
- * presumes the spec's full method surface; the v0.1 adapter contract
+ * presumes a broader method surface; the v0.1 adapter contract
  * deliberately narrows it, leaving most capabilities with NO honestly
- * checkable method pair. Those defer to the §19 conformance suite, which
- * validates declared records against observed behavior:
- *
- *  - `linkPicking`: native picking arrives through mount-time host events
- *    (`onLinkClick`/`onLinkHover`), not a probeable `linkAt` method — there
- *    is nothing on the engine object to compare the record against.
- *  - `edgeArrows` / `pointImages` / `rangeUpdates`: honored inside
- *    `commit()` payload handling (`config.linkArrows`, `resources`, ranged
- *    uploads) with no distinguishing method; only behavior can validate them.
- *  - `simulation`: `start()`/`pause()` are mandatory on every engine (static
- *    engines no-op them), so method presence carries no signal either way.
- *  - `pointsInPolygon`-family (`pointsInRect`, `captureScreenshot`,
- *    `neighborIndices`, `screenToSpace`/`spaceToScreen`, `setPinnedIndices`,
- *    `zoomToIndex`): optional-by-contract with no declaring capability bit —
- *    absence is legitimate, so no check is fabricated for them.
+ * checkable method pair. Those are instead covered by engine probes that
+ * validate declared records against observed behavior:
+ *
+ * - `linkPicking`: native picking arrives through mount-time host events
+ * (`onLinkClick`/`onLinkHover`), not a probeable `linkAt` method — there
+ * is nothing on the engine object to compare the record against.
+ * - `edgeArrows` / `pointImages` / `rangeUpdates`: honored inside
+ * `commit()` payload handling (`config.linkArrows`, `resources`, ranged
+ * uploads) with no distinguishing method; only behavior can validate them.
+ * - `simulation`: `start()`/`pause()` are mandatory on every engine (static
+ * engines no-op them), so method presence carries no signal either way.
+ * - `pointsInPolygon`-family (`pointsInRect`, `captureScreenshot`,
+ * `neighborIndices`, `screenToSpace`/`spaceToScreen`, `setPinnedIndices`,
+ * `zoomToIndex`): optional-by-contract with no declaring capability bit —
+ * absence is legitimate, so no check is fabricated for them.
  *
  * The one honest pair on this surface: `trackedPositions` declares position
  * readback works, so `getPositions` must actually be present.
@@ -2821,10 +2830,10 @@ declare function resolveEnginePolicy(capabilities: EngineCapabilities, requested
 declare function assertCapabilityMethodParity(engine: GraphEngine): string[];
 /**
  * Strip commit payload the engine's capability record says it cannot honor:
- *  - `resources` (image atlas + per-point image index) unless `pointImages`;
- *  - `config.linkArrows` unless `edgeArrows`;
- *  - `config.cluster` unless `clusterForce` (§16.3 stage 4 — the core keeps
- *    membership, labels, and centroids; only the FORCE is engine-side).
+ * - `resources` (image atlas + per-point image index) unless `pointImages`;
+ * - `config.linkArrows` unless `edgeArrows`;
+ * - `config.cluster` unless `clusterForce` (stage 4 — the core keeps
+ * membership, labels, and centroids; only the FORCE is engine-side).
  * A `config` left empty by the strip is dropped entirely.
  *
  * IDENTITY-PRESERVING: when nothing needs stripping the SAME commit object
@@ -2837,15 +2846,15 @@ declare function normalizeCommitForCapabilities(commit: EngineCommit, capabiliti
 };
 
 /**
- * §8 shared numeric hygiene (R-19-10) — THE single coercion layer for every
+ * shared numeric hygiene — THE single coercion layer for every
  * numeric consumer in orbit-core.
  *
  * Wherever a caller-supplied value feeds a numeric sink — size/width
- * projection buffers (§8), scale domains (§11), metric columns (§12),
- * crossfilter bins (§16.6), table lanes — the value is REQUIRED to route
+ * projection buffers, scale domains, metric columns,
+ * crossfilter bins, table lanes — the value is REQUIRED to route
  * through `coerceNumeric` / `coerceNumericInto`. Non-numeric and non-finite
  * inputs (including the string sentinels `"NaN"` / `"Infinity"` /
- * `"-Infinity"` that JSON transports smuggle through, §5) coerce to `null`:
+ * `"-Infinity"` that JSON transports smuggle through) coerce to `null`:
  * the row falls back to the default style and is excluded from domain
  * computation. NaN NEVER escapes this module — not as a return value and not
  * into a GPU buffer.
@@ -2853,16 +2862,15 @@ declare function normalizeCommitForCapabilities(commit: EngineCommit, capabiliti
  * Coercion rules:
  * - numbers pass iff `Number.isFinite` (NaN / ±Infinity → null);
  * - strings are trimmed; empty → null; the case-insensitive sentinels
- *   'NaN' / 'Infinity' / '-Infinity' / '+Infinity' → null; anything else
- *   parses via `Number(...)` and passes iff finite (so '1e3' → 1000 but
- *   '12px' → null — `Number`, not `parseFloat`, so no partial prefixes);
+ * 'NaN' / 'Infinity' / '-Infinity' / '+Infinity' → null; anything else
+ * parses via `Number(...)` and passes iff finite (so '1e3' → 1000 but
+ * '12px' → null — `Number`, not `parseFloat`, so no partial prefixes);
  * - booleans, objects, arrays, functions, symbols, bigints, null, and
- *   undefined → null (no `valueOf`/`toString` coercion side channels).
+ * undefined → null (no `valueOf`/`toString` coercion side channels).
  *
- * FOLLOW-UP (do not fix here): `crossfilter.ts` predates this module and
- * carries its own inline finite checks; migrating it to route through
- * `coerceNumeric` is a tracked S10 follow-up so the sentinel-string rules
- * stay defined in exactly one place.
+ * `crossfilter.ts` predates this module and retains its own inline finite
+ * checks. Any consolidation must route through `coerceNumeric` so the
+ * sentinel-string rules stay defined in exactly one place.
  */
 declare function coerceNumeric(value: unknown): number | null;
 /**
@@ -2877,31 +2885,31 @@ declare function coerceNumeric(value: unknown): number | null;
 declare function coerceNumericInto(target: Float32Array, index: number, value: unknown, fallback: number): boolean;
 
 /**
- * §12 metrics (v0.8 subset): lazy degree-family primitives over the
+ * metrics (v0.8 subset): lazy degree-family primitives over the
  * maintained topology plus revision-gated admission of async metric columns.
  *
  * - The degree family (degree / inDegree / outDegree) is computed LAZILY on
- *   first request per model revision, in ONE combined O(n + L) pass, and
- *   cached as Float64Arrays until the model revision changes.
+ * first request per model revision, in ONE combined O(n + L) pass, and
+ * cached as Float64Arrays until the model revision changes.
  * - SELF-LOOP SEMANTICS: a self-loop (a, a) contributes exactly 1 to each of
- *   degree, inDegree, and outDegree of `a`. The CSR adjacency lists a
- *   self-loop twice under its point (once per endpoint slot, see
- *   adjacency.ts), so degree = CSR row length MINUS the point's self-loop
- *   count; in/out come from a directed pass over the flat link pairs.
- * - Async columns join once against the accepted model (§12): 'index' align
- *   is positional over accepted-base order; 'ids' align joins by id with
- *   unknown ids counted+sampled, duplicate ids counted (last occurrence
- *   wins), and absent rows null. Every value routes through `coerceNumeric`
- *   (§8 hygiene, R-19-10). A column computed for a stale model revision is
- *   DISCARDED with a diagnostic — admission is the correctness gate, abort
- *   is only an optimization (§9.2).
+ * degree, inDegree, and outDegree of `a`. The CSR adjacency lists a
+ * self-loop twice under its point (once per endpoint slot, see
+ * adjacency.ts), so degree = CSR row length MINUS the point's self-loop
+ * count; in/out come from a directed pass over the flat link pairs.
+ * - Async columns join once against the accepted model: 'index' align
+ * is positional over accepted-base order; 'ids' align joins by id with
+ * unknown ids counted+sampled, duplicate ids counted (last occurrence
+ * wins), and absent rows null. Every value routes through `coerceNumeric`.
+ * A column computed for a stale model revision is
+ * DISCARDED with a diagnostic — admission is the correctness gate, abort
+ * is only an optimization.
  * - Storage encodes null as NaN inside Float64Arrays; `getMetricValue`
- *   converts back at the boundary so NaN never escapes to callers.
+ * converts back at the boundary so NaN never escapes to callers.
  * - Admitted columns SHADOW the built-in degree family under the same name
- *   (a precomputed/server 'degree' column wins; §12 precomputed path).
+ * (a precomputed/server 'degree' column wins; precomputed path).
  */
 
-/** Topology snapshot the degree family is computed from (§12). */
+/** Topology snapshot the degree family is computed from. */
 interface MetricModelInput<N = Record<string, unknown>> {
     /** Accepted nodes in accepted-base order (index i ↔ point i). */
     nodes: readonly GraphNode<N>[];
@@ -2933,7 +2941,7 @@ declare class MetricStore<N = Record<string, unknown>> {
     /** Admitted async columns by metric name; NaN encodes null. */
     private readonly columns;
     private degreePasses;
-    /** §17 telemetry: estimated bytes of metric storage held (S13-T07). */
+    /** telemetry: estimated bytes of metric storage held. */
     estimatedBytes(): number;
     /** Number of combined degree-family compute passes (test observability). */
     get degreeComputePasses(): number;
@@ -2946,10 +2954,10 @@ declare class MetricStore<N = Record<string, unknown>> {
      */
     setModel(model: MetricModelInput<N>): void;
     /**
-     * Joins async metric columns against the accepted model (§12).
+     * Joins async metric columns against the accepted model.
      * Revision-gated PER COLUMN (I1): a column whose issue-time
      * `forModelRevision` stamp differs from `opts.modelRevision` is discarded
-     * (info diagnostic — a normal async race outcome, §9.2). A missing or
+     * (info diagnostic — a normal async race outcome). A missing or
      * mismatched stamp is never defaulted to the current revision — that
      * would make the gate self-satisfying.
      * Structural rejections ('index' length mismatch, missing/mismatched ids)
@@ -2966,7 +2974,7 @@ declare class MetricStore<N = Record<string, unknown>> {
     getMetricValue(metric: MetricName, index: number): number | null;
     /**
      * Raw column in accepted-base order, or null when unavailable. NaN encodes
-     * null (§12) — consumers exclude NaN slots from domains. Do NOT mutate:
+     * null — consumers exclude NaN slots from domains. Do NOT mutate:
      * this is the live cache, not a copy.
      */
     metricValues(metric: MetricName): Float64Array | null;
@@ -2978,22 +2986,22 @@ declare class MetricStore<N = Record<string, unknown>> {
 }
 
 /**
- * §16.8 minimap / overview — CPU fallback lane (S11-T09/T10).
+ * minimap / overview — CPU fallback lane.
  *
  * v0.9 trim: no engine exposes `capabilities.overviewPass` yet (cosmos has no
- * second draw pass — M0 matrix), so this controller IS the minimap thumbnail
- * path: an O(n) CPU rasterization of the §7.1 position mirror into a small
+ * second draw pass — matrix), so this controller IS the minimap thumbnail
+ * path: an O(n) CPU rasterization of the position mirror into a small
  * RGBA dot field. It is a pure controller — no DOM, no canvas — the React
  * component blits the returned `Uint8ClampedArray` into an `ImageData`/canvas
- * and draws the viewport rectangle on top (O(1) from `getViewport()`, fully
+ * and draws the viewport rectangle on top (O(1) from `getViewport`, fully
  * decoupled from thumbnail refresh cadence).
  *
- * Refresh cadence (spec §16.8): ≤ 2 Hz while the simulation is hot (positions
+ * Refresh cadence: ≤ 2 Hz while the simulation is hot (positions
  * change continuously on the GPU, so the epoch is ignored), ≤ 1 Hz after a
  * change while idle, and ZERO work while idle with an unchanged positions
  * epoch — `shouldRefresh` is the single throttle gate and latches its clock /
  * epoch only when it answers true (a `true` must be followed by one
- * `rasterize()`).
+ * `rasterize`).
  *
  * Orientation: minimap pixel y grows DOWNWARD while world (space) y grows
  * upward — the same flip cosmos applies in its space→screen scale (dist
@@ -3032,7 +3040,7 @@ interface OverviewRaster {
     bitmap: Uint8ClampedArray;
     bounds: OverviewBounds;
 }
-/** Spec §16.8: the CPU fallback rasterizes into a 256² target. */
+/** Spec the CPU fallback rasterizes into a 256² target. */
 declare const OVERVIEW_SIZE_DEFAULT = 256;
 /** Hot-simulation refresh floor: ≤ 2 Hz. */
 declare const OVERVIEW_HOT_INTERVAL_MS = 500;
@@ -3042,7 +3050,7 @@ declare class OverviewController {
     private readonly getScene;
     private readonly getVisible;
     readonly size: number;
-    /** Transform of the LAST rasterization; null until rasterize() succeeds. */
+    /** Transform of the LAST rasterization; null until rasterize succeeds. */
     private frame;
     private lastRefreshMs;
     private lastEpoch;
@@ -3052,16 +3060,16 @@ declare class OverviewController {
      * when it returns true, so each `true` accounts for exactly one refresh:
      *
      * - hot (`simulationRunning`): time-gated only (≤ 2 Hz) — the epoch is
-     *   ignored because positions change continuously without epoch advances;
+     * ignored because positions change continuously without epoch advances;
      * - idle: refresh only when the epoch ADVANCED since the last refresh,
-     *   time-gated at ≤ 1 Hz;
+     * time-gated at ≤ 1 Hz;
      * - idle + unchanged epoch: always false — zero work, forever.
      */
     shouldRefresh(nowMs: number, simulationRunning: boolean, epoch: number): boolean;
     /**
      * Rasterizes the current scene into a fresh `size²` RGBA dot field: 1 px
      * white dots whose alpha ACCUMULATES on overlap (heatmap-ish density),
-     * dimmed for mask-hidden points; NaN pairs (§7.3 tombstones) are skipped.
+     * dimmed for mask-hidden points; NaN pairs are skipped.
      * World bounds map into the thumbnail with a 5 % edge padding at a UNIFORM
      * scale (aspect preserved, centered on the short axis) and a downward pixel
      * y (see module header). Returns null when there is no scene or no point.
@@ -3077,34 +3085,34 @@ declare class OverviewController {
 }
 
 /**
- * §16.14 SVG export (S15 export lane) — the M7 pure module.
+ * SVG export — the engine-free pure module.
  *
  * ENGINE-INDEPENDENT BY CONSTRUCTION, not by discipline: positions and
  * projected styles come IN as a plain descriptor, vector markup goes OUT as a
  * string. No engine, no instance, no DOM — the post-v1 server snapshot path
- * (spec §13, R-13-53) reuses this verbatim under plain Node, and the test
+ * reuses this verbatim under plain Node, and the test
  * suite runs it exactly that way. Keeping it engine-free is an M7
  * requirement, which is why it is a standalone module rather than instance
  * code that might one day be extracted.
  *
- * Output discipline (§16.14):
- *  - One element per node/edge/label, assembled OFF-DOM by chunked
- *    array-join — O(elements), never a live DOM node per element.
- *  - Every label and attribute string is XML-escaped (§14's untrusted-content
- *    rule in its XML form): a hostile label renders as literal text in every
- *    downstream vector tool, never as markup.
- *  - Bounded: above `maxElements` (default 50 000 — the practical ceiling for
- *    downstream vector editors) rendering THROWS before assembling anything;
- *    the instance wraps that into the typed `export-too-large` rejection, and
- *    the raster-hybrid form (a PNG base layer plus a small vector overlay) is
- *    the sanctioned way past it.
+ * Output discipline:
+ * - One element per node/edge/label, assembled OFF-DOM by chunked
+ * array-join — O(elements), never a live DOM node per element.
+ * - Every label and attribute string is XML-escaped (untrusted-content
+ * rule in its XML form): a hostile label renders as literal text in every
+ * downstream vector tool, never as markup.
+ * - Bounded: above `maxElements` (default 50 000 — the practical ceiling for
+ * downstream vector editors) rendering THROWS before assembling anything;
+ * the instance wraps that into the typed `export-too-large` rejection, and
+ * the raster-hybrid form (a PNG base layer plus a small vector overlay) is
+ * the sanctioned way past it.
  */
 interface SvgSceneNode {
     x: number;
     y: number;
     /** Radius in output px (the caller halves its size-buffer diameter). */
     r: number;
-    /** Any CSS color string (the caller projects RGBA buffers to rgba()). */
+    /** Any CSS color string (the caller projects RGBA buffers to rgba). */
     color: string;
 }
 interface SvgSceneEdge {
@@ -3162,21 +3170,23 @@ declare function escapeXml(text: string): string;
 declare function renderSvg(scene: SvgScene, opts?: RenderSvgOptions): string;
 
 /**
- * §5.1 columnar-NATIVE acceptance rules (PR-F wave 1, ADR-006) — the column
- * -domain twin of validate.ts, built to run INSIDE the worker over typed
+ * Columnar-native acceptance rules — the column-oriented twin of validate.ts,
+ * built to run INSIDE the worker over typed
  * columns without materializing a single row object.
  *
  * Semantics mirror the object lane EXACTLY (the equivalence oracle pins
  * rosters AND diagnostics, message strings included):
- *  - duplicate node ids drop, first occurrence wins ('duplicate-node-id',
- *    warning) — and edges addressing a dropped duplicate ROW remap to the
- *    surviving occurrence, because the object lane resolves endpoints by ID
- *    STRING, which survives.
- *  - duplicate edge ids drop, first wins ('duplicate-edge-id', warning).
- *  - self-loops are RETAINED with 'self-loop-retained' (info).
- *  - invalid-node / invalid-edge / dangling-edge cannot occur here: ids come
- *    from a structurally validated dictionary column and endpoints are
- *    in-bounds indices by prior validation (validateColumnarStructure).
+ * - duplicate node ids drop, first occurrence wins ('duplicate-node-id',
+ * warning) — and edges addressing a dropped duplicate ROW remap to the
+ * surviving occurrence, because the object lane resolves endpoints by ID
+ * STRING, which survives.
+ * - duplicate edge ids drop, first wins ('duplicate-edge-id', warning).
+ * - self-loops are RETAINED with 'self-loop-retained' (info).
+ * - invalid-node / invalid-edge rows with NUL-reserved ids drop here;
+ * dangling edges can then arise when an endpoint names a dropped invalid
+ * node. Other structural corruption cannot occur because ids come from a
+ * structurally validated dictionary column and endpoints are in-bounds
+ * indices by prior validation (validateColumnarStructure).
  *
  * Duplicates hide in TWO encodings: two rows sharing a code, and two
  * DISTINCT dictionary entries holding equal strings. Both are handled by
@@ -3211,21 +3221,21 @@ interface ColumnarAcceptance {
 declare function acceptColumnar(snapshot: ColumnarGraphSnapshot<unknown, unknown>): ColumnarAcceptance;
 
 /**
- * §5 columnar snapshot lane (S13-T01, ADR-006) — structural validation and
+ * columnar snapshot lane — structural validation and
  * the materialization bridge.
  *
  * Validation is O(number of columns + rows) and runs BEFORE transfer or
  * admission. Columnar structural corruption is intentionally not repaired
- * row by row — offset/index misalignment can reinterpret every later row —
+ * row by row — offset/index misalignment can reinterpret every later row
  * so any structural issue rejects the WHOLE snapshot, the prior scene stays
- * intact, and nothing throws from a React render (spec §5.1).
+ * intact, and nothing throws from a React render.
  *
  * The bridge materializes a VALID columnar snapshot into the object form and
  * feeds the existing pipeline, so duplicate-id / dangling-edge / self-loop
  * resolution stays in exactly one place (validate.ts) and the columnar lane
- * inherits every object-lane rule by construction (ADR-006: T01 lands
- * behind `execution: 'main'` with zero behavior change). The
- * zero-materialization path arrives with the worker waves.
+ * inherits every object-lane rule by construction. Under `execution: 'main'`
+ * materialization remains synchronous; the worker lane can perform acceptance
+ * off-thread before the same shared pipeline runs.
  *
  * Null semantics: `nulls` is one byte per row, nonzero = null. Null attr
  * values materialize as `null` (JSON-ish; every numeric/temporal consumer
@@ -3242,7 +3252,7 @@ interface ColumnarIssue {
 }
 /**
  * O(columns + rows) structural validation. Empty array ⇒ structurally sound
- * (duplicate ids, self-loops, and parallel-edge rules are NOT checked here —
+ * (duplicate ids, self-loops, and parallel-edge rules are NOT checked here
  * they are shared object-lane semantics applied after materialization).
  */
 declare function validateColumnarStructure(snapshot: ColumnarGraphSnapshot<unknown, unknown>): ColumnarIssue[];
@@ -3266,7 +3276,7 @@ declare function buildAcceptedFromColumnar<N, E>(snapshot: ColumnarGraphSnapshot
 declare function columnarArrayBuffers(snapshot: ColumnarGraphSnapshot<unknown, unknown>): ArrayBuffer[];
 /**
  * `bufferOwnership: 'transfer'` — detach every underlying ArrayBuffer.
- * Called ONLY after validation and admission both succeeded (ADR-006 D4:
+ * Called ONLY after validation and admission both succeeded:
  * reject-before-allocation extends to reject-before-detach). Returns the
  * number of buffers detached. SharedArrayBuffer-backed views are skipped
  * (they cannot detach and remain shared by contract).
@@ -3274,8 +3284,8 @@ declare function columnarArrayBuffers(snapshot: ColumnarGraphSnapshot<unknown, u
 declare function detachColumnarBuffers(snapshot: ColumnarGraphSnapshot<unknown, unknown>): number;
 
 /**
- * §17 serializable field descriptors (S13-T01, ADR-006 D1) — the worker-lane
- * accessor forms: `FieldAccessor` + `SerializableTransform` + the `field()`
+ * serializable field descriptors — the worker-lane
+ * accessor forms: `FieldAccessor` + `SerializableTransform` + the `field`
  * manual-schema helper. Descriptors are DATA, never code: they cross the
  * worker boundary by structured clone, compare by canonical structural
  * value, and unknown transform ops are validation errors (spec: "descriptors
@@ -3293,14 +3303,14 @@ declare function detachColumnarBuffers(snapshot: ColumnarGraphSnapshot<unknown,
  * projection ever runs.
  */
 
-/** Branded attr path — `field<A,T>()` is a manual-schema ASSERTION (compile
- * -time narrowing for codegen/schema packages), not runtime validation. */
+/** Branded attr path — `field<A,T>` is a manual-schema ASSERTION for
+ * compile-time narrowing in codegen/schema packages, not runtime validation. */
 type TypedFieldPath<A, T> = string & {
     readonly __attrs?: A;
     readonly __value?: T;
 };
 declare function field<A, T>(path: string): TypedFieldPath<A, T>;
-/** §17 transform whitelist. Closed set — extending it is a spec amendment. */
+/** transform whitelist. Closed set — extending it is a spec amendment. */
 type SerializableTransform = {
     op: 'identity';
 } | {
@@ -3347,7 +3357,7 @@ declare function isFieldAccessor(value: unknown): value is FieldAccessor<unknown
 declare function descriptorKey(accessor: FieldAccessor<unknown, unknown>): string;
 /**
  * Evaluate a descriptor against an entity's `(id, attrs)` — the pure
- * function both lanes share (ADR-006 D2: byte-exact parity starts with ONE
+ * function both lanes share (byte-exact parity starts with ONE
  * evaluation implementation, imported by both threads, never duplicated).
  */
 declare function evaluateFieldAccessor(accessor: FieldAccessor<unknown, unknown>, id: string, attrs: Readonly<Record<string, unknown>> | undefined): unknown;