The Archive Map — a 2-D projection of the corpus

One point per LOGICAL memory (a chunked memory is one place, at the centroid of its chunks), in the unit square. Omit ns for every namespace in the workspace; pass it for one — a cold basis costs a PCA FIT per bank, which takes seconds on a large namespace.

THE MAP DOES NOT RESHUFFLE. The basis is fitted once and reused, so a memory written after the fit is placed by the existing basis and moves nothing. basis_version is the corpus_version the basis was fitted at; basis_stale means memories have landed since. Treat that as an OFFER to re-fit (POST …/projection/refit), never as a trigger — the point of the feature is that the map stays put.

CACHED per (workspace, namespace, include_properties, credential namespace ceiling) with a 5-minute TTL — longer than property-stats because the payload is stable by construction: only a re-fit or a Kairos restart moves a point. cache.hit is true when the answer cost no upstream call and therefore no billing.

READ BEFORE DRAWING: do not label an axis flagged in degenerate_axes — its points all sit at the constant 0.5, and drawing that as a spatial dimension presents a constant as a finding. Publish variance_explained: [0.21, 0.13] means the map explains 34% of what the embeddings encode. skipped counts memories with no vector at all (pre-ML rows), which are excluded from points rather than placed somewhere invented. A point's properties value may be an explicit null — 'no value', which a color scale must distinguish from a low one. Set include_properties=false only if you are not coloring.

Requires the memories:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying memories:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES memories:read — every key minted before scoping keeps working here.