fix(adr-025): correct the LOD depth formula — n = 16^r (4×4), not 4-ary

Closes Codex P2 on PR #44 (now merged).

# The error

ADR-025 §2 said sample size "n ≈ 16^r for a 4-ary radix pyramid."
That is internally inconsistent: a 4-ary pyramid grows as n = 4^r,
and the cited level formula r* = ⌈log₄(C/τ)⌉ only follows from
n = 16^r. As written, an implementer of D-JC-PREDICT-LOD building
against the documented 4-ary pyramid would pick a level half as
deep as needed and leave the predicted error above tolerance.

The runtime session's original numbers were actually self-consistent
on n = 16^r (it gave n^{-1/2} = 4^{-r} and r* = ⌈log₄(C/τ)⌉, which
all agree). The only slip was my mislabeling the branching as
"4-ary" — the pyramid increases resolution ×4 in BOTH x and y per
hop, so 4 × 4 = 16 samples per level.

# The fix

Rewrite §2 with an explicit, self-checking derivation:

  n = b^r
  predicted_error_L = C · n^{-1/2} = C · b^{-r/2}
  predicted_error_L < τ  ⟹  r* = ⌈2·log_b(C/τ)⌉      (general)
  helix pyramid ships b = 16 (×4 per axis = 4 × 4)
  ⟹ n = 16^r, n^{-1/2} = 4^{-r}
  ⟹ r* = ⌈2·log_16(C/τ)⌉ = ⌈log₄(C/τ)⌉              (canonical anchor)

The canonical formula r* = ⌈log₄(C/τ)⌉ and the "5-12 hop" range are
preserved (the §Consequences line now annotates it as the b = 16
reduction of r* = ⌈2·log_b(C/τ)⌉). The "4-ary radix pyramid" label
is removed.

# Implementer note added

The §2 block now carries an explicit warning: build the level
formula on the pyramid's true per-level SAMPLE growth (n = 16^r),
not its per-axis fan-out (×4). Pairing the ⌈log₄⌉ pick with a
pyramid that actually grows only n = 4^r selects a level half as
deep as that pyramid needs (a 4-ary pyramid needs ⌈log₂(C/τ)⌉,
since log₂ = 2·log₄) and leaves the error above tolerance — exactly
the failure mode Codex flagged.

# Review

Numerically re-derived and verified:
  - 2·log_16(C/τ) == ⌈log₄(C/τ)⌉ across C/τ ∈ {1024, 4096, 1e5, 1.67e7}
  - n^{-1/2} == 4^{-r} at b = 16
  - footgun direction: applying ⌈log₄⌉ to a 4-ary pyramid picks
    exactly half the needed depth (ratio 0.50 vs ⌈log₂⌉) — matches
    Codex's "half as deep as needed"
  - 5-12 hop band (b=16): r*=5 ⇔ C/τ~1024, r*=12 ⇔ C/τ~1.68e7

No "4-ary" mislabel remains in the doc. PII abort-guard
(word-boundary): CLEAN. cargo check --workspace --all-targets: clean
(docs-only).

https://claude.ai/code/session_01PBTGaPCSnnt6u3pjXpbLwY

Author: claude

docs/ARCHITECTURAL-DECISIONS-2026-06-04.md

@@ -1427,13 +1427,29 @@ to pick its work, with zero data-dependent branches:
    NiblePath arithmetic; no float-rounding daylight between them.
 
 2. **Jirak says which level L the cheap path will succeed at.**
-   For the LOD pyramid:
-     `n` = current sample size at level L (e.g. n ≈ 16^r for a
-     4-ary radix pyramid)
-     `predicted_error_L = C · n^{-1/2}` (L^q regime, which the
-     Σ-sandwich Mahalanobis distance lives in)
-     `r* = ⌈log₄(C/τ)⌉` for clinical tolerance τ — closed-form,
+   For the LOD pyramid, sample size grows by a fixed branching factor
+   `b` per hop-radius increment: `n = b^r`. Then:
+     `predicted_error_L = C · n^{-1/2} = C · b^{-r/2}`
+   (L^q regime, which the Σ-sandwich Mahalanobis distance lives in).
+   Solving `predicted_error_L < τ` for the smallest accepting level:
+     `C · b^{-r/2} < τ  ⟹  b^{r/2} > C/τ  ⟹  r > 2·log_b(C/τ)`
+     **`r* = ⌈2·log_b(C/τ)⌉`** for clinical tolerance τ — closed-form,
      evaluated once per task class.
+   The helix pyramid ships **`b = 16`** (16-way per-hop sample growth
+   — the pyramid increases resolution ×4 in **both** x and y per hop,
+   so `4 × 4 = 16` samples per level; per the runtime session's
+   helix-pyramid spec), so `n = 16^r`, `n^{-1/2} = 4^{-r}`, and the
+   general formula reduces to the canonical anchor:
+     `r* = ⌈2·log_16(C/τ)⌉ = ⌈log₄(C/τ)⌉`.
+   **Implementer note for `D-JC-PREDICT-LOD`:** build the level
+   formula on the pyramid's true per-level *sample* growth, not its
+   per-axis fan-out. Here the ×4 per-axis fan-out gives `n = 16^r`
+   (`= 4 × 4` per level) → `r* = ⌈log₄(C/τ)⌉`. The trap Codex flagged:
+   pairing that `⌈log₄⌉` pick with a pyramid that actually grows only
+   `n = 4^r` selects a level **half as deep as that pyramid needs** —
+   a 4-ary pyramid needs `r* = ⌈log₂(C/τ)⌉` (since `log₂ = 2·log₄`) —
+   and so leaves the predicted error above tolerance. Verify the real
+   `b` before wiring the formula.
    No per-frame probing; the LOD pick is `r*` directly.
 
 3. **HHTL routes the prefix at the picked level.**
@@ -1520,9 +1536,10 @@ ADR-024 → §11 callouts in PR #475 + PR #476).
 - **Cesium tileset `bounding_volume` becomes a derived field** for
   helix+HHTL-shaped tilesets. Producer/renderer round-trip lossless
   by construction.
-- **5-12 hop range = `r* = ⌈log₄(C/τ)⌉`** evaluated against
-  clinical (FMA registration), pixel (Cesium SSE), and tile (OSM
-  pyramid) tolerances. Same formula across the three domains; the
+- **5-12 hop range = `r* = ⌈log₄(C/τ)⌉`** (the `b = 16` reduction of
+  `r* = ⌈2·log_b(C/τ)⌉`) evaluated against clinical (FMA
+  registration), pixel (Cesium SSE), and tile (OSM pyramid)
+  tolerances. Same formula across the three domains; the
   per-domain Jirak certificate supplies `C`.
 - **theta ∈ [1.45, 1.6] window** is the regime where the Jirak
   bound applies cleanly to palette256 distances (ADR-024 codec).