docs: record peer benchmark invariant

CAPABILITY-MAP.md

@@ -41,7 +41,7 @@ Build sequence: data foundation → identity and analytics → API → dashboard
 ## Cross-cutting invariants
 
 1. Tenant isolation is enforced server-side on every merchant-scoped operation.
-2. Cross-merchant output is aggregate and anonymized; no row-level peer data is exposed.
+2. Cross-merchant output is aggregate and anonymized; no row-level peer data is exposed. Peer benchmarks use other merchants in the active merchant's category for the same selected period, exclude the active merchant, and require at least 10 peers plus 1,000 combined peer sessions.
 3. Every displayed metric has a definition, source fields, filters, time window, and drill-down path.
 4. Dataset imports are repeatable and produce a versioned manifest with checksum, counts, timestamps, and validation results.
 5. Secrets stay outside Git; examples contain names and safe placeholders only.
@@ -56,6 +56,7 @@ Build sequence: data foundation → identity and analytics → API → dashboard
 14. Each section attempt is limited to 60 seconds and at most two transient retries with exponential backoff/jitter; deterministic errors fail immediately.
 15. The worker pins pre-1.0 Asynq `v0.26.0`, runs at 16 jobs globally and 4/merchant by default, and changes require reviewed dependency/load evidence.
 16. Start, manual-retry, and SSE limits use independent authenticated-user/merchant buckets and return `429` with `Retry-After` before work is queued. SSE heartbeats run every 15 seconds and authorized run-event replay lasts one hour.
+17. Peer outputs use the median of one independently calculated value per eligible merchant plus a direction-aware merchant performance percentile. Equal merchant weighting is intentional because transaction weighting would let the dataset's largest merchants dominate the benchmark.
 
 ## Required capability specs