Teleport scaling — what the cache-key teleport can do, and how it scales

Broadcast the cache key, not the request. The key crosses the gap; the compute does not. The further the gap, the more you save.

This is the scaling companion to TELEPORT.md. It answers one question along five axes: as you grow distance, stations, cache, fleet, and witnesses, what happens to the teleport's value? Read TELEPORT.md first for the mechanism; this file is the scaling argument.

Bridge discipline (read this before any number)

This repo separates what the Lean kernel checks from what hardware/physics reports. Every claim below is tagged:

• [KERNEL] — checked by a Lean theorem with no omega/simp/Mathlib. The arithmetic or the admission algebra is machine-verified.
• [PROVEN-HW] — observed on real silicon (RTL-SDRs / Pluto / R1s), recorded in .qa-artifacts/. Empirical, repeatable, not a theorem.
• [MEASURED-SW] — measured in software (deterministic bench / sim), no radio.
• [MODELED] — physics/link-budget math applied on the bench; interplanetary distance is modeled (Eb/N0-equivalence), never waited out in real seconds.
• [DESIGN] — intended behavior, specified but not yet proven end-to-end.

We do not claim faster-than-light anything. Causality is intact. The trick is refusing to pay the round trip: the answer was computed once and frozen; a tiny key tells the far side which frozen answer to serve. A request the cache has never seen is a miss and pays full cost. The teleport is real; the magic is bookkeeping. See LIMITATIONS.md (forthcoming) for the honest caveats and BENCHMARKS.md (forthcoming) for the raw numbers.

1. What it can do today (the PROVEN floor)

These are not aspirations; they are recorded on hardware or checked by Lean.

The whole point: every runtime calls one admission primitive (teleport_admit), so the demo is not rigged — it is the production gate.

2. Latency scaling — the headline axis

This is where the value lives. A teleport replay is local and roughly constant; a round trip grows with distance as 2d/c. So the savings ratio grows without bound as distance grows.

• Local geodesicLength:0 replay ≈ 0.19 ms [MEASURED-SW] (constant; it never traverses compute space — TELEPORT_GEODESIC_LENGTH = 0 in src/teleport.rs).
• The round trip it avoids is the modeled light-time 2d/c [MODELED].

Measured savings (round-trip avoided ÷ local replay), 2026-05-24:

The crucial structural fact, not just the table:

[KERNEL] teleport_savings_monotone_in_distance (MarsDistanceLadder.lean): the avoided round-trip light-time is non-decreasing in distance. Replay cost is distance-independent. Therefore the ratio is monotone increasing in distance.

In plain terms: the value of teleport grows with distance. A miss still pays the full round trip, so the headline only applies to cache hits — but for the work you have cached, farther is strictly better. This inverts the usual networking intuition where distance is pure cost.

3. Cache scaling — small-N by design, density-protected

The cache (AmplituhedronCache, src/amplituhedron.rs) is deliberately small and simple. It is keyed by (prefix_hash, prefix_len, layer_lo, layer_hi) and serves a frozen (tail_residual, kv_slab) on an exact-match hit.

How a single station scales:

• Linear scan over a tiny Vec is intentional. DEFAULT_MAX_VOLUMES = 8. At single-digit N, a hash map adds per-probe overhead with no win. replay runs once per session and capture once per prefill. [MEASURED-SW] (29 lib tests green; bench numbers in BENCHMARKS.md, forthcoming).
• Per-station memory is O(prefix_len × layers_in_range) — it stores whatever the integration step hands it, no reshape. The default tuning is "~256–512 token system prompt, 8 entries × ~2 MiB/slab ≈ 16 MiB resident." Multi-layer stations call set_max_volumes(2).
• Liquid-memory eviction protects long, hot volumes. Eviction is not pure LRU; the victim is the lowest-density entry, where density = prefix_len × (hit_count + 1). A 512-token slab that went quiet beats a 16-token cold stub, because the value of a frozen volume is the prefill compute it eliminates. Discarded density accumulates in heat_released (the Landauer accounting column). Mirrors LiquidMemoryTopology.lean (held + vent = max_volumes + 2).
• memory_pressure() ∈ [0,100] routes load: when a station is near its ceiling, send the next session to a less-loaded worker.

How the cache scales across stations: the key is tiny (a few integers: prefix hash/len, layer range). Broadcasting it is O(1) in the size of the result — you ship the index, not the answer. So:

• More stations ⇒ more aggregate cache (each holds its own ≤8 hot volumes).
• The broadcast cost to address any cached answer does not grow with how big that answer is. A 2 MiB KV slab and a 200 MiB one cost the same to address.

Honest cache limits (full list in LIMITATIONS.md):

• Exact-match keying. Any divergence in the token stream changes prefix_hash and forces a miss. This is the soundness guard (timeless_isomorphism covenant) — it is correct, but it means near-matches do not hit.
• A miss pays full cost. The cache amortizes; it does not conjure.
• Small N per station. Capacity is single-digit volumes by design; the fleet, not the single node, is the scaling unit (see §4).

4. Fleet / mesh scaling — the amortization engine

A single station has a tiny cache. A fleet turns those tiny caches into shared, replicated, self-healing compute. Two mechanisms compose.

4a. The /chain mesh self-organizes replicated stages

From R1_RESILIENT_MESH.md:

• A model is sharded into stages (layer ranges); each stage is held by ≥2 replicas; no node is load-bearing. [PROVEN-HW]
• /chain relays a forward to the next stage's replica pool; on timeout it retries an alternate — failover = re-send, because a hop is a pure function of (residual, start_pos, layer_range). [PROVEN-HW] (3/3 fail over past a dead replica).
• Membership is UDP gossip on mesh stream 2010; missed heartbeats evict; new nodes get an under-replicated stage and must pass the qspec golden-star gate before serving. [PROVEN-HW]
• Verified sovereign R1↔R1 over WiFi: caller → R1#1 → R1#2 → correct argmax, 766 ms warm, no coordinator in the data path; self-heals on a bricked replica within the gossip window. [PROVEN-HW]

Teleport rides this transport unchanged (the protocol69 RF-gossip bridge and the pre-/chain teleport-admit probe are [DESIGN], specified in R1_MESH_PROTOCOL69.md). The payoff: a cache-warm hop on any replica skips recompute, and the warm volume is reachable from every node that can route to that replica. More nodes ⇒ more replicas ⇒ more independent places a given hot volume can live ⇒ higher fleet-wide hit probability.

4b. The "vacuum of the future" — losers pre-populate the cache

This is the compounding mechanism. FOIL races default to FOIL_RACE_LOSER_POLICY=integration (the README's "integration / vacuum of the future"). When a race finishes:

• The winner is returned immediately, unchanged. [KERNEL] integration_preserves_cancel_winner (FoilLoserPolicy.lean): changing the loser policy cannot change the present winner.
• Cacheable off-path loser work is admitted onto a bounded resident queue for later reuse. [KERNEL] admitted_integration_residue_bounded (admission ≤ capacity; overflow is dropped via try_send, never blocking the winner) and integration_residue_from_cacheable_losers (every retained entry came from a listed cacheable non-winner candidate).
• On stale/absent cache, the path rebuilds for the current winner and can admit fresh loser work. [KERNEL] stale_recovery_uses_current_winner, stale_integration_recovery_preserves_cancel_winner.

Why this compounds across a fleet: a future request of the same shape, arriving inside the latency window, inherits the lower-entropy structure the losers already computed — without re-running it. The first request pays; the admitted residue makes subsequent same-shape requests cheap. Spread that admission across many stations and a fleet steadily front-loads its own future cache hits. The Lean boundary keeps this honest: it is future-facing only and bounded — it never escalates loser work back into the synchronous race, and it never changes a result. (Measured FOIL loser-policy latencies: integration ~838 ns mean vs cancel ~1352 ns mean on a 20k fib(20) run; cancel is lower-overhead when no future benefit is wanted. [MEASURED-SW] — see BENCHMARKS.md.)

The teleport is what turns that fleet-wide warm cache into a remote win: once a volume is warm somewhere reachable, the key — not the result — is what travels.

5. Witness scaling — Skymesh, no pairwise links

Skymesh removes the link entirely: N air-gapped receive-only stations independently derive the same integer witness off one ambient broadcast and all admit the same teleport (skymesh-witness.ts, SKYMESH_DEMO.md).

How witness entropy scales:

• Spectral fingerprint: energy binned into 64 fine bands; the witness is the top-K (K=3) dominant band indices, 8 bits each. Entropy grows with the number of bands and the richness of the decoded field. 64 bands was chosen empirically: the carrier bin is gain-invariant (same Hz on both receivers) and discriminative; coarser (16) under-discriminates, finer (128) splits the carrier. [PROVEN-HW] (two real NESDRs: identical top-3 off one FM station, zero shared with a different station, despite a ~2-bit gain gap).
• Resilient agreement: two witnesses agree on ≥WITNESS_MIN_SHARED (=2) shared dominant bands — tolerates the noisiest band flipping between receivers while still rejecting a different sky. [KERNEL] agree_monotone, agree_tolerates_one_flip (SkymeshTeleport.lean).
• Higher-entropy / more-legible alternates: a decoded RDS station id or an ADS-B ICAO address is an exact integer both stations recover off the air — more entropy and human-legible, matched at shared == K (exact). [DESIGN]/ alternate source (rtl_433 decoded-field path is implemented; extractWitnessFromRtl433).

The scaling claim: the broadcast is O(1) in the number of receivers. One ambient carrier admits N stations with zero pairwise links between them — add receivers for free. Forgery and a different sky both fail closed (genuine_sky_forged_key_denied).

Honest witness limit: the spectral witness needs a strong, anchored carrier. Quiet RF bands under-discriminate (the top-K bands become noise-dominated and agreement degrades). Use the decoded-field path (RDS/ADS-B/rtl_433) where a clean carrier is not guaranteed. Full caveat in LIMITATIONS.md.

6. Interplanetary / relay scaling — and where it honestly breaks

The distance ladder (distance-ladder.ts) sweeps ISS → GEO → Moon → planets → deep-space landmarks → the interstellar wall at a fixed DSN-class reference (REFERENCE_CONFIG: X-band, 34 m ground dish, 20 W spacecraft, MFSK8 + RS+conv + 4-way Whip).

Two monotone facts the ladder rides (both [KERNEL], mirrored numerically):

• friis_loss_monotone_in_distance — link loss grows as d², so margin is non-increasing in distance (margin_antitone_of_loss_monotone).
• teleport_savings_monotone_in_distance — avoided round-trip is non-decreasing.

The dominance theorem is the relay engine:

[KERNEL] margin_closes_at_dmax_implies_closes_below — if the link closes at the hardest rung you prove, it closes at every nearer rung. You prove once at the far end and relay the proof down the ladder by monotonicity.

How far it closes, honestly [MODELED] at the reference config: the link closes through Mars at all three regimes (33–51 dB margin) and keeps closing out to New Horizons, then breaks at Voyager 1 (−2.4 dB). We report the break rung rather than hide it (breakRung in the sweep; the interstellar wall at Proxima is well past it). A bigger dish / more power / lower rate moves the break rung out; the structure (monotone, dominance) is unchanged.

Multi-hop relay [DESIGN] (DTN store-carry-forward over the @a0n/aeon DTN stack, mars-teleport-demo.mts step 4): a key is carried through intermediate stations — Earth → Moon → Mars → Jupiter — each hop store-and-forwarding the small key. The demo reports the round trip it avoids (Earth→…→Jupiter ~6,694 s). Because each rung's link is dominated by the rung beyond it, a chain that closes at the hardest hop closes at every easier hop — the same dominance argument, applied per-hop. The relay carries a key, so per-hop bandwidth is O(1) in result size.

7. Honest limitations on scaling

Pointers; the canonical list is LIMITATIONS.md (forthcoming).

• Cache-hit required. Every headline ratio in §2 is a hit. A miss pays the full round trip (cachedReplay:false in the cert proves exactly what teleport avoids). Teleport amortizes; it does not create answers.
• Exact-prefix keying. prefix_hash exact-match is the soundness guard — any token-stream divergence misses. No fuzzy / near-prefix hits.
• Small per-station cache. DEFAULT_MAX_VOLUMES = 8, linear scan, memory O(prefix_len × layers). The fleet is the scaling unit, not the node.
• Witness reliability. The spectral Skymesh witness needs a strong anchored carrier; quiet bands under-discriminate. Prefer decoded-field witnesses there.
• RX-only / Eb/N0-equivalence caveat. RTL-SDRs cannot transmit; interplanetary distance is [MODELED] on the bench (Eb/N0-equivalence + real link-budget physics), never waited out in real minutes. This is on-theme — deep-space operation is receive-dominant: you listen and serve locally rather than pay a synchronous round trip.
• Single process per RTL device. One process owns one RTL-SDR; concurrent capture on the same device is not supported.
• DTN multi-hop relay and the RF-gossip / pre-/chain teleport probe are [DESIGN], not yet proven end-to-end. The primitives they compose (admission, replay, gossip, /chain failover) are proven; the compositions are specified.

The scaling story in one paragraph

The cache key is tiny and the replay is local and constant, so the only thing that grows is the round trip you refuse to pay — which means teleport's value is monotone increasing in distance (kernel-checked), bounded only by where the physical link honestly breaks (Voyager 1 at the reference config, reported not hidden). Per station the cache is deliberately small and density-protected; the fleet is the scaling unit, where gossip-replicated /chain stages and the bounded "vacuum of the future" loser-integration front-load future hits without ever changing a result (kernel-checked). Witnesses scale O(1) in receivers off a single ambient broadcast with no pairwise links. None of this beats light; all of it refuses to pay for it twice.

Cross-links

• TELEPORT.md — mechanism, hardware proofs, first-class table.
• MARS_DELAY_TOLERANT_TELEPORT.md — light-time A/B, the distance latency table, the relay chain.
• SKYMESH_DEMO.md — two air-gapped stations, the witness.
• R1_RESILIENT_MESH.md — the /chain mesh teleport rides.
• BENCHMARKS.md — raw numbers (forthcoming).
• LIMITATIONS.md — the honest caveat list (forthcoming).
• Lean: MarsDistanceLadder.lean (savings/loss monotonicity, dominance); FoilLoserPolicy.lean (winner-unchanged, bounded integration); gnosis-math/Gnosis/SkymeshTeleport.lean (admission shape, fail-closed family).
• Code: src/teleport.rs, src/amplituhedron.rs, src/bin/fat-station.rs, rtlsdr-mock-sim/{distance-ladder,skymesh-witness}.ts.