Terminus: where the mind lives

Proposal section 5: where the mind lives

Somewhere in the twilight band a child holds a glowing slate and asks it why rivers bend. The question leaves the slate as a whisper of WiFi, reaches the squat gray terminal her village found on a parachute, leaps 2,200 km to a satellite of the wheel — a satellite that will drop below her horizon in a quarter of an hour, mid-conversation if the conversation is good.

So where is the thing that answers? Every section so far has moved messages. This one has to place a mind — and minds, it turns out, are heavy in a very particular way.

What a mind weighs

A large language model is two things. The first is its knowledge: billions of numbers, fixed at training time, the same for every user on the planet. Think of it as the frozen mind — enormous, but it never changes, so it can be copied anywhere in advance at leisure.

The second thing is the conversation itself. As the model reads each word you send, it writes itself notes — a compact mathematical summary of everything said so far, which is how the ten-thousandth word can depend on the first. Engineers call these notes the KV cache; call it the working memory. Unlike the frozen mind, it grows with every token (a token is a word or piece of one), it is different for every conversation, and it cannot be regenerated cheaply — lose it, and the model must re-read the entire conversation to rebuild it. For the model our patron is donating, the arithmetic is fixed by its shape:

/// Per-token key/value-cache footprint of a transformer model: for every
/// token processed, each layer stores a key and a value vector per KV head.
impl KvCacheModel {
    /// Bytes of KV cache appended per token of context.
    pub fn bytes_per_token(&self) -> f64 {
        (2 * self.layers * self.kv_heads * self.head_dim * self.bytes_per_value) as f64
    }
}

Eighty layers, eight KV heads, 128 numbers each, two bytes per number, keys and values both: 320 KiB of working memory per token. A conversation is not weightless:

   context (tok)  size (GB)   @10 Gbps (s)  @100 Gbps (s)
            8192        2.7            2.1           0.21
           32768       10.7            8.6           0.86
          131072       42.9           34.4           3.44

A long tutoring session — thirty-odd thousand tokens — drags eleven gigabytes of irreplaceable state behind it. Now put that fact next to the wheel's fast rhythm: the serving satellite changes every 11 minutes — the spacing between satellites in a ring, not the 16.6 a single one could manage overhead. If the mind lives on the access satellite, those eleven gigabytes must chase the child across the sky at every handover, forever, for every conversation on the planet at once. And that is only the second problem with the obvious design; the first is that it puts a copy of the frozen mind — and the accelerators and radiators to run it — on all seventy-two relay satellites, seventy of which are coasting over dead ice at any given moment.

Separate the radio from the mind

Our answer is the second architectural principle of this proposal, the peer of "fixed rings, moving duty":

An access handover is a routing event, not a mind-moving event.

The wheel's satellites carry no conversations in their heads. They are relays — radio below, laser links above, switching in between. Each conversation is owned by exactly one session anchor: a compute satellite that holds the working memory and runs the model. When the child's satellite sets, her packets take a different path through the wheel to the same anchor. The mind never felt the handover.

Where do the anchors orbit? The survey's shelf menu, priced in light time — the toolkit labels the shelves in Earth's catalog shorthand, MEO for these middle orbits:

cargo run -p terminus-orbits --example compute_placement

Anchor candidates:
  MEO 20,000 km, overhead         17800 km    59.4 ms one way from access
  MEO 20,000 km, 30° away         19427 km    64.8 ms one way from access
  MEO 20,000 km, 60° away         23299 km    77.7 ms one way from access
  L1/L2 balance points           146347 km    0.49 s one way from planet
  L4/L5 (orbital radius)         7.26e6 km   24.2 s one way from planet

The high shelves we called slow giants in the survey are exactly what a mind wants. A compute satellite at 20,000 km stays overhead for three and a half hours, and — as the next section will show — a session can in fact keep one indefinitely, riding out every access handover beneath it without moving a byte of working memory. And a slow giant has room to be a giant: the accelerators, the solar wings, the radiators that a mind's heat demands, none of which we now have to squeeze into seventy-two small relays. A handful of large compute satellites replaces six dozen compromised ones, and the frozen mind is copied a handful of times instead.

How many is a handful? Anchoring alone would be content with about six — one per plane, always something reachable overhead. The shell we finally build carries 24, and the extra 18 are bought by a service that has nothing to do with conversation: the planet's compass, which needs four satellites in view at once and gets them from the same orbits. That story belongs to the backbone; here it is enough to know the minds are not the reason the shell is crowded.

Does the budget survive the extra hop? The RFP allows 300 milliseconds to the first word of a reply. Worst geometry — child at the edge of her satellite's footprint, anchor 60 degrees around the sky:

2 x (12.1 + 77.7) ms = 180 ms round trip, leaving 120 ms of
thinking time inside the RFP's 300 ms budget.

Tight but honest, and typical geometry is kinder. The balance points fail exactly where you would expect: L1/L2 sit half a light-second out — you cannot converse across it. But "too slow to talk, impossible to steal" is a fine description of a vault. That is where the durable copies live: every conversation's transcript, replicated from its anchor a few times a minute; the model repository; the checkpoints. The star stole the stationary orbit from us in the survey; the same celestial arithmetic donates two addresses it can never touch. L4/L5, 24 seconds away, we reserve for the patient work — training the next mind, archiving the civilization's library.

Why not let the giants speak directly?

Before this section closes, our evaluator deserves an answer to the sharpest question it invites: if the slow giants are so capable, why keep the wheel at all? Let the MEO shell serve the terminals directly — one constellation for radio and mind alike, a handover every three hours instead of every 11 minutes, no relay layer to build. It is a genuinely tempting architecture, and we priced it before declining it:

cargo run -p terminus-orbits --example access_trade

  worst-case slant: 23039 km vs 3642 km  ⇒  +16.0 dB path loss
  to recover at the terminal alone: 0.5 m dish → 3.2 m, or 40x power
  splitting recovery with the satellite: terminal still needs 1.26 m

  1° spot radius: 175 km vs 19.2 km  ⇒  83x less spatial reuse

The extra distance costs sixteen decibels — a factor of forty in power — and someone must pay it. The satellites could pay half and still leave every terminal needing an antenna face over a meter across; the whole ground segment is ten thousand unattended boxes under parachutes, and every future box forever, so hardware added there is the most expensive hardware in the system. And the beams coarsen: a spot from MEO covers a province, not a town, surrendering the dense frequency reuse that the million-terminal future depends on. The wheel stays — not because the giants could not speak, but because they would make the listeners expensive, and this proposal spends on spacecraft precisely so the ground can stay simple. The full accounting is recorded as ADR-0012, and the declined option earns one consolation role: a settlement willing to raise a single larger community dish gains a direct line to the MEO shell — an emergency door if its ring service ever fails.

Which anchor, and for how long

Anchoring the mind above the weather is only half a decision. The other half is which anchor, and the tempting answers are all wrong in the same way: they ask what one satellite can see.

Start with the vantage. It is natural to ask which anchor stands highest over the child's village, but no link crosses that horizon. The feeder link runs from the access satellite up to the shell. It is equally natural, then, to ask what that satellite can see — and that is wrong too, because the session is not confined to it. Each ring's satellites are joined to their immediate neighbors by laser links — two per satellite, aimed once and held for years, closing the ring into what a later section will name the necklace — so a session can leave its ring through any ring mate, and the horizon that matters belongs to the whole ring. And a ring is a great circle: it can see every anchor in the shell at every instant, never with fewer than seven of its twelve satellites.

That single fact rearranges the problem. Reachability is never the binding constraint. No anchor is ever out of reach, so no anchor ever has to be abandoned; a session could hold the one it started with for as long as the conversation lasts. What is left to decide is not whether the session can keep its anchor but whether it should — a question about latency, not about geometry.

So the rule is the shortest path the ring can offer: a few necklace hops, at 4,437 km and 14.8 ms of light apiece, plus the feeder link up to the anchor. A hop costs a little more than its light, because the ring mate has to catch the frame, decode it, switch it, and send it on again — half a millisecond of processing, which the routing counts. What it compares is therefore time rather than distance (ADR-0023).

That extra half millisecond settles more than it looks. A detour pays only when the ring mate's feeder link is shorter by more than the whole cost of getting there, and at the adopted margin it never is: across a day of following a thousand towns, the routing never once leaves the ring through a neighbor. A session free to re-anchor holds an anchor its own satellite can already see. The necklace still earns its place — it pools the ring's feeder terminals, it stays lit where the radios are dark, and it is what rescues a session when a telescope fails — but not by shortening the everyday road.

The margin in that diagram is the only number here the sky does not fix, and it turns out to be the most consequential number in the whole backbone. A session gives up its anchor only when some rival is shorter by more than the margin — so the margin decides how often minds move, and minds moving is the most expensive thing this network can do. Sweeping it:

cargo run --release -p terminus-orbits --example feeder_terminals

 margin (km)  changes/day   mean path    p95 path  p95 round trip  think left
           0       113.37   18,569 km   19,807 km          157 ms      143 ms
        2500        19.13   19,084 km   20,799 km          164 ms      136 ms
        5000        12.70   20,075 km   22,925 km          178 ms      122 ms
       10000         7.08   21,915 km   27,337 km          208 ms       92 ms
       20000         4.05   25,494 km   35,471 km          263 ms       37 ms
       25000         0.00   28,385 km   39,332 km          290 ms       10 ms

The last column decides. The RFP allows 300 ms to the first token. The round trip spends what it spends — the radio leg at each end, the path across the backbone, a relay at every satellite that forwards — and the model has to produce that token in whatever is left over.

Read the two ends against each other, and neither can be bought. Chasing the shortest path moves every session more than a hundred times a day, and at a million terminals that is 156 Gbps of working memory on the busiest feeder link: more than a 100-gigabit link can carry. Holding hardest moves them never, and leaves 10 ms to think in, which is not a budget.

We take the middle. The margin is 5,000 km. A session changes anchor 12.70 times a day — about once every 113 minutes, roughly ten access handovers — and 122 ms of thinking time survives the round trip. The backbone pays 17.5 Gbps on its busiest feeder link for that, and that is the whole trade. This network is sized by one policy number rather than by anything its users do.

That is a correction, and it should be said plainly. An earlier draft of this argument took the bottom row: a 20,000 km margin, chosen precisely because it produced zero migrations. The reasoning was sound, and one of its inputs was wrong. Routing had been counting a necklace hop against how many ring mates a satellite can see — two, at 2,200 km — rather than how many it has a laser terminal aimed at, which is one. A hop moves one place, not two. Correcting it doubled the price of every hop, lengthened every held path, and slid the whole curve underneath the conclusion: at 20,000 km a session now moves four times a day and keeps 37 ms to think in. The margin that still produces no migrations at all is 25,000 km, and it is unaffordable.

Unaffordable against what, though, is worth saying out loud, because it is not the sky. It is TER-REQ-003. The 300 ms to the first token is the customer's number, and it is the only thing anywhere in this argument that rejects the zero-migration margin. Run the same sweep against first-token budgets the RFP does not grant — its 600 ms is a degraded budget, for a session being carried around a failed link, and never applies to a network that is working — and the verdict moves:

cargo run --release -p terminus-orbits --example feeder_terminals

  thinking time left under other first-token budgets

  margin (km)      300 ms      500 ms      600 ms
            0      143 ms      343 ms      443 ms
         2500      136 ms      336 ms      436 ms
         5000      122 ms      322 ms      422 ms
        10000       92 ms      292 ms      392 ms
        20000       37 ms      237 ms      337 ms
        25000       10 ms      210 ms      310 ms

Read the bottom row across. At 300 ms, a 25,000 km margin leaves 10 ms to think in and is thrown out for it. At 500 ms, the same margin leaves 210 ms — more thinking time than the adopted policy has today — while still moving no session at all, which means a backbone carrying no working memory except after a failure. A 500 ms budget would buy a network with almost no migration traffic in it, and the backbone section would have had a very different bill to write.

The proposal does not take that trade and is not asking for it. The distance from 300 ms to 500 ms is the distance between an answer that feels instant and one that feels merely quick, and that judgment belongs to the people who will live with the service rather than to the people building it. What the table does is stop the requirement from hiding inside the design. TER-REQ-003 is not a fact about this sky; it is a decision somebody made, and the margin is where the design pays for it.

Two things follow, and the proposal should say both plainly. The first is that this is an operating parameter, not a constant of the sky — the one number in the anchor policy that geometry does not settle. It must be tunable in flight, because the second thing is a debt: a session moves to shorten its own path and never to spare an anchor's compute. Nothing here models the load on an anchor, so nothing here notices sessions accumulating on whichever anchor happens to sit over a crowded stretch of the band. The margin is the only lever there is, and it moves every session at once. Recorded as ADR-0020; the selection rule and the instants it runs at are stated precisely in the algorithms appendix.

One consequence lands straight on the build. A session that moves 12.70 times a day, at the million-terminal ceiling, is more than a million migrations a day — each one inside a live conversation that must not stall. Streaming a session's working memory from one anchor to the next, make-before-break, had been deferred out of the first release because nothing ever moved. That premise is gone, and so is the deferral (ADR-0022).

There is a pleasing symmetry with the wheel below, and it is not a coincidence. The activation plan decides which access satellites a town may newly attach to, but a satellite already carrying traffic is by definition radiating and does not get switched off underneath a live link. Acquisition answers to policy; retention answers to geometry. Once at 2,200 km and again at 20,000 km, the same sentence keeps the network from chasing its own planner instead of the sky.

All of which is easier to watch than to describe. Turn on Follow a town and click anywhere on the planet to put a terminal down — it lands in the twilight band, because that is the only ground this fleet serves. Three things are then drawn: the town, the pale link up to whichever access satellite is carrying it, and the longer line onward to the anchor holding its session. Press play. The link snaps to a new satellite every 11 minutes, and the route to the anchor swings, but does not break — that is an access handover being a routing event, and it is the whole argument of this section rendered at about a thousand times real speed. Keep watching, and the anchor changes too, about once every 113 minutes of simulated time. Pull re-anchor margin down, and it changes constantly; push it up to 25k, and it stops changing at all. That dial is the trade above, made visible.

The anchor line is the one to watch. It never passes through the planet. Where the ring's own satellite is not the best door out, you will see the route step sideways along the necklace before it climbs — though at the default margin you will not see it at all, because a session free to re-anchor always finds an anchor its own satellite can reach. Push the margin to 20k or 25k, pin the session to a distant anchor, and the sidestep appears: one hop, sometimes two or three. Six would cross the ring, and nothing in a day of simulation ever needed more than three.

When the anchor must move after all

We long called this the one migration we could not design away. It turns out the sky never forces it: nothing ever takes an anchor out of a ring's reach, so no session is ever compelled to move by geometry. What moves sessions is the policy above, and three things that were never geometric — an anchor that must yield to maintenance, an anchor that goes dark into a single ring while staying perfectly alive, and an anchor that fails.

The policy is the common case, and not narrowly. At a 5,000 km margin, a session changes anchor 12.70 times a day, and at the million-terminal ceiling that is more than a million migrations a day across the fleet. Every one of them is planned, every one has a live source still holding the data, and every one happens inside a conversation somebody is waiting on.

Maintenance is forgiving, because orbits are clocks and a servicing window is known months out. The ceremony is the one we always described: the next anchor loads the frozen mind in advance, the working memory streams across the laser backbone — eleven gigabytes in under a second at 100 gigabits — while the old anchor is still answering, and for one overlapped moment both hold the conversation before routing flips. That is precisely the ceremony an ordinary re-anchor needs, which is rather the point.

A dark ring is the second case — the one the backbone will add to the list when it wires the fleet. An anchor reaches each ring through exactly one feeder telescope (the laser terminal behind that ring's feeder link), so losing that telescope does not degrade the pair; it severs it: the anchor goes on holding every mind it has and answering every session on its other five rings, and cannot be reached from the sixth. Every session on that pair has to move. It is forgiving in the maintenance way — the source is alive, so the streaming path below is available — and unforgiving in a way the policy is not, because it moves a whole bucket in the same instant instead of one session at a time. That burst is what sizes the feeder links.

Failure is not forgiving, and it is the case that decides what the vault is for. An anchor struck or silenced mid-sentence takes its working memory with it; there is nothing left to stream. The vault at L1/L2 holds the transcript, a new anchor re-reads it, and the conversation resumes having lost at most its final exchange — exactly the bound the RFP demands, and the answer we committed to from the start.

What the vault cannot do is stand in for the streaming path. So we build it. An earlier draft deferred make-before-break out of the first release, on the reasoning that streaming would serve planned migrations only and the first release would have none. That followed from a 20,000 km margin and does not survive 5,000: rebuilding working memory from a transcript that the old anchor is still holding costs a full prefill in the middle of a sentence, a dozen times a day per session. Recovery from a dead anchor stays a prefill, because nothing better is possible. A planned move has no such excuse. Recorded as ADR-0022, which supersedes ADR-0021.

The shape of the whole

The architecture has become three layers, each doing the one thing its altitude is best at:

   L1/L2 vault        transcripts, models, checkpoints   (0.49 s away)
        │
   MEO anchors        the minds: weights + working memory  (~65 ms away)
        │
   access wheel       radio + switching, 72 relays        (~12 ms away)
        │
   twilight band      terminals, slates, questions

Recorded as ADR-0004, with two debts declared openly: the laser backbone this architecture leans on is asserted, not yet designed, and we have not said how many anchors the MEO shelf needs. Both bills come due in later sections.

That is half the proposal, and everything above the ground now exists in outline: the twilight band, the six rings of the access wheel, and the MEO shell that holds the minds. It is worth seeing that turning rather than stacked in a diagram. The constellation explorer is a live 3D model of what the last five sections argued for — change the altitude and the ring count and watch the coverage numbers move, or scrub through a planet rotation and watch the orbital planes drift against the fixed terminator. Come back when the shapes are familiar.

What follows is louder. Every link in this chain — slate to terminal, terminal to wheel, wheel to anchor — is a radio or laser beam, and all of it operates in the presence of a red dwarf that flares, seethes, and broadcasts static across the very bands a terrestrial engineer would reach for first. It is time to design for the loudest thing in the sky.