@hviana/sema 0.2.3 → 0.2.4

package/dist/src/mind/mechanisms/cast.d.ts

@@ -1,4 +1,5 @@
 import type { MindContext } from "../types.js";
+import type { Vec } from "../../vec.js";
 /** A CAST answer plus its elementary evidence for think's grounding decider:
  *  `accounted` — the query spans the weave's aligned runs explain; `moves` —
  *  the ladder cost of the acts the taken branch performed (STEP per
@@ -13,6 +14,59 @@ export interface CastResult {
      *  Task 2 note in pipeline.ts's Candidate interface). */
     unexplained: string;
 }
+/** The seat that establishes a node's role in an analogical comparison:
+ *  the REVERSE context (what leads to it) when a predecessor genuinely
+ *  ESTABLISHES id — introduces or describes it by name — else the FORWARD
+ *  continuation (what it leads to), else `fallback`.
+ *
+ *  An earlier version gated this purely on `prevCount(id) > 0`: any
+ *  predecessor at all was treated as proof of a genuine named ENTITY
+ *  (seat it by what established it), while no predecessor meant a bare
+ *  learnt CONTEXT (seat it by what it leads to, since voicing it verbatim
+ *  would answer a question with a question).  That test measured the wrong
+ *  thing — a broad sample of this store's own question-shaped nodes showed
+ *  the large majority (≈71%) have at least one predecessor, most of them a
+ *  handful of generic, high-fan-out sentences that recur as an INCIDENTAL
+ *  neighbour to dozens of otherwise-unrelated destinations (a SmolSent-
+ *  style sentence-adjacency artifact, never naming or describing what
+ *  follows).  Traced live: "What is the capital of France?" — whose own
+ *  forward edge unambiguously resolves to "The capital of France is
+ *  Paris." — has exactly one such incidental predecessor ("Create an
+ *  example of a types of questions a GPT model can answer.?"), wrongly
+ *  read as disqualifying proof of "genuine entity."
+ *
+ *  A plain forward-first swap (matching {@link project}'s universal
+ *  priority) over-corrected: test/29's C2/C3 pin that a genuine entity
+ *  analog (e.g. "Leonardo da Vinci", established by "The Mona Lisa was
+ *  painted by Leonardo da Vinci.") must be seated by that establishing
+ *  sentence, NOT by its own biography fact — voicing the bio leaks exactly
+ *  what a comparison must keep out, and loses the embedded "Mona Lisa"
+ *  term C3 relies on for a further hop.
+ *
+ *  The distinguishing signal is content-addressed, not a count: a genuine
+ *  establishing predecessor's bytes CONTAIN id's own bytes — it names or
+ *  describes id ("...painted by Leonardo da Vinci." contains "Leonardo da
+ *  Vinci").  An incidental adjacency predecessor never does — it merely
+ *  preceded id in some unrelated document without ever mentioning it.  No
+ *  new tuned constant: containment is the same primitive `restatesQuery`
+ *  and `dominates`-style checks already use throughout this codebase.
+ *
+ *  `allowForward` (default true) gates the FORWARD branch specifically —
+ *  see the call sites below: the DOMINANT is what the query is actually
+ *  ASKING, so completing it forward is the whole point; an ANALOG is only
+ *  being CITED for comparison; the query never asked about IT, so chasing
+ *  its own further continuation drifts onto whatever coincidentally
+ *  follows it in the corpus.  Traced live: the analog "What is the capital
+ *  of Japan?\nTokyo is the capital of Japan." is ALREADY a complete,
+ *  self-answering unit (prevCount 0, so no establishing predecessor
+ *  either) — its sole forward edge is "And what is the capital of the
+ *  Moon?", an unrelated quiz question sharing nothing but corpus
+ *  adjacency.  With forward disallowed, an analog like this falls through
+ *  to `fallback` — its own bytes, exactly the complete fact that made it a
+ *  genuine analog in the first place.  See
+ *  test/41-seatofnode-direction.test.mjs and
+ *  test/43-cast-analog-seat.test.mjs. */
+export declare function seatOfNode(ctx: MindContext, id: number, guide: Vec | null | undefined, fallback: Uint8Array, allowForward?: boolean): Promise<Uint8Array>;
 /** CAST's own entry gates, checked once here and reused by
 /** The main CAST entry point.  Given a query and its pre-computed pre.rec.sites,
  *  determine whether the query weaves together multiple independent learnt

package/dist/src/mind/mechanisms/cast.js

@@ -11,14 +11,16 @@
 // gate = the frame gate below + analogyStrength, projection = insert / project /
 // juxtapose.
 import { read } from "../primitives.js";
-import { argmaxBy, hubBound } from "../traverse.js";
+import { argmaxBy, corpusN, hubBound } from "../traverse.js";
 import { analogyStrength, follow, project, reverseContext, } from "../match.js";
 import { joinWithBridge } from "../resonance.js";
+import { restatesQuery } from "../reasoning.js";
 import { CONCEPT, STEP } from "../graph-search.js";
 import { concat2, indexOf } from "../../bytes.js";
-import { dominates } from "../../geometry.js";
-import { unexplainedLabel } from "../rationale.js";
+import { consensusFloor, dominates } from "../../geometry.js";
+import { unexplainedLabel, unexplainedSpans, } from "../rationale.js";
 import { rItem, rNode } from "../trace.js";
+import { dismissedKnownContent } from "../bridge.js";
 // ── CAST gates ────────────────────────────────────────────────────────────
 //
 // The frame gate has TWO components, both derived from the weave itself:
@@ -52,6 +54,81 @@ import { rItem, rNode } from "../trace.js";
  *  minimum: `depth > MIN_WEAVE` means at least three structures agree on a
  *  byte, so no byte is frame when only the minimum pair exists. */
 const MIN_WEAVE = 2;
+/** The seat that establishes a node's role in an analogical comparison:
+ *  the REVERSE context (what leads to it) when a predecessor genuinely
+ *  ESTABLISHES id — introduces or describes it by name — else the FORWARD
+ *  continuation (what it leads to), else `fallback`.
+ *
+ *  An earlier version gated this purely on `prevCount(id) > 0`: any
+ *  predecessor at all was treated as proof of a genuine named ENTITY
+ *  (seat it by what established it), while no predecessor meant a bare
+ *  learnt CONTEXT (seat it by what it leads to, since voicing it verbatim
+ *  would answer a question with a question).  That test measured the wrong
+ *  thing — a broad sample of this store's own question-shaped nodes showed
+ *  the large majority (≈71%) have at least one predecessor, most of them a
+ *  handful of generic, high-fan-out sentences that recur as an INCIDENTAL
+ *  neighbour to dozens of otherwise-unrelated destinations (a SmolSent-
+ *  style sentence-adjacency artifact, never naming or describing what
+ *  follows).  Traced live: "What is the capital of France?" — whose own
+ *  forward edge unambiguously resolves to "The capital of France is
+ *  Paris." — has exactly one such incidental predecessor ("Create an
+ *  example of a types of questions a GPT model can answer.?"), wrongly
+ *  read as disqualifying proof of "genuine entity."
+ *
+ *  A plain forward-first swap (matching {@link project}'s universal
+ *  priority) over-corrected: test/29's C2/C3 pin that a genuine entity
+ *  analog (e.g. "Leonardo da Vinci", established by "The Mona Lisa was
+ *  painted by Leonardo da Vinci.") must be seated by that establishing
+ *  sentence, NOT by its own biography fact — voicing the bio leaks exactly
+ *  what a comparison must keep out, and loses the embedded "Mona Lisa"
+ *  term C3 relies on for a further hop.
+ *
+ *  The distinguishing signal is content-addressed, not a count: a genuine
+ *  establishing predecessor's bytes CONTAIN id's own bytes — it names or
+ *  describes id ("...painted by Leonardo da Vinci." contains "Leonardo da
+ *  Vinci").  An incidental adjacency predecessor never does — it merely
+ *  preceded id in some unrelated document without ever mentioning it.  No
+ *  new tuned constant: containment is the same primitive `restatesQuery`
+ *  and `dominates`-style checks already use throughout this codebase.
+ *
+ *  `allowForward` (default true) gates the FORWARD branch specifically —
+ *  see the call sites below: the DOMINANT is what the query is actually
+ *  ASKING, so completing it forward is the whole point; an ANALOG is only
+ *  being CITED for comparison; the query never asked about IT, so chasing
+ *  its own further continuation drifts onto whatever coincidentally
+ *  follows it in the corpus.  Traced live: the analog "What is the capital
+ *  of Japan?\nTokyo is the capital of Japan." is ALREADY a complete,
+ *  self-answering unit (prevCount 0, so no establishing predecessor
+ *  either) — its sole forward edge is "And what is the capital of the
+ *  Moon?", an unrelated quiz question sharing nothing but corpus
+ *  adjacency.  With forward disallowed, an analog like this falls through
+ *  to `fallback` — its own bytes, exactly the complete fact that made it a
+ *  genuine analog in the first place.  See
+ *  test/41-seatofnode-direction.test.mjs and
+ *  test/43-cast-analog-seat.test.mjs. */
+export async function seatOfNode(ctx, id, guide, fallback, allowForward = true) {
+    const rev = ctx.store.prevFirst(id, hubBound(ctx));
+    if (rev.length > 0) {
+        const own = read(ctx, id);
+        const establishing = rev.some((p) => indexOf(read(ctx, p), own, 0) >= 0);
+        if (establishing) {
+            const back = reverseContext(ctx, id, guide, rev);
+            if (back !== null)
+                return back;
+        }
+    }
+    // The "last resort, non-establishing reverse" fallback below is itself a
+    // LESS CERTAIN projection (the same tier as forward) — an analog
+    // (allowForward: false) must stop at `fallback` (its own bytes) here
+    // rather than fall back to a predecessor that already failed the
+    // establishing check just above.
+    if (!allowForward)
+        return fallback;
+    const fwd = await follow(ctx, id, guide);
+    if (fwd !== null)
+        return fwd;
+    return reverseContext(ctx, id, guide, rev) ?? fallback;
+}
 /** CAST's own entry gates, checked once here and reused by
 /** The main CAST entry point.  Given a query and its pre-computed pre.rec.sites,
  *  determine whether the query weaves together multiple independent learnt
@@ -222,7 +299,8 @@ export async function counterfactualTransfer(ctx, query, pre) {
         const tail = proj.ctx.subarray(seat.cs);
         let answer = await joinWithBridge(ctx, filler, tail);
         const fwd = await follow(ctx, proj.anchor, qv);
-        if (fwd !== null && indexOf(answer, fwd, 0) < 0) {
+        if (fwd !== null && indexOf(answer, fwd, 0) < 0 &&
+            !restatesQuery(query, fwd)) {
             answer = concat2(answer, fwd);
         }
         ctx.trace?.step("projectCounterfactual", [
@@ -278,30 +356,8 @@ export async function counterfactualTransfer(ctx, query, pre) {
     // seed-dependent failure where the climb ranks an exemplar above a
     // person node and the person node is excluded from points by run-
     // overlap trimming.
-    // The seat that establishes a candidate's role: the REVERSE projection
-    // (the context it follows), voiced by the query gist — falling back to the
-    // candidate's own bytes when it follows nothing.  DELIBERATE STRENGTHENING
-    // over the pre-refactor code: reverseContext also returns null when the
-    // picked context READS EMPTY (a dangling id degrades to zero bytes), so a
-    // corrupted-store read now falls back here instead of voicing a hollow
-    // seat into the comparison — the same "empty bytes are no grounding"
-    // invariant project() has always enforced.
-    // A node that only ever CONTINUES — an edge SOURCE with no predecessor —
-    // is a learnt CONTEXT (a stored question-shaped frame), not an entity.
-    // Voicing it verbatim answers a question with a question (the observed
-    // cast echo: two stored questions concatenated as an "answer").  The
-    // context's role is established by what it LEADS TO, so its seat is its
-    // own continuation — the fact — with the reverse projection and the raw
-    // bytes as the ordinary fallbacks for genuine entities.
-    const seatOfNode = async (id, fallback) => {
-        if (ctx.store.prevCount(id) === 0 && ctx.store.hasNext(id)) {
-            const fwd = await follow(ctx, id, qv);
-            if (fwd !== null)
-                return fwd;
-        }
-        return reverseContext(ctx, id, qv) ?? fallback;
-    };
-    const seatOf = (p) => seatOfNode(p.anchor, p.ctx);
+    // The seat that establishes a candidate's role — see {@link seatOfNode}.
+    const seatOf = (p, allowForward = true) => seatOfNode(ctx, p.anchor, qv, p.ctx, allowForward);
     const analogs = [];
     for (const p of points) {
         if (p === dominant)
@@ -335,15 +391,49 @@ export async function counterfactualTransfer(ctx, query, pre) {
     }
     let bestAnalog = null;
     let bestSim = 0;
+    let bestHalo = false;
+    // Whether the query itself NAMES a candidate.  A directly aligned point
+    // is named by construction — its runs ARE query bytes.  A hop-reached
+    // candidate is named when its own bytes contain the query text of an
+    // aligned run of the point whose continuation edge reached it (that
+    // alignment IS the query evidence the hop rests on — the same reading
+    // cmpAccounted already prices): "William Shakespeare", reached off
+    // "Macbeth was written by William Shakespeare.", contains the src's
+    // 12-byte aligned run " Shakespeare" — test/29 C2/C3.  The run must span
+    // at least TWO perception windows (2·W, the same two-quantum floor
+    // CAST's own entry gate holds the whole query to): a single shared
+    // W-window is exactly the frame tier's own evidence quantum — the level
+    // "half the corpus" shares — and stopword scraps (" the ", "he b",
+    // 4–5 bytes) never reach two windows, while a genuinely named entity
+    // does.  NOT the weave's usable()/frame filter: weave depth counts every
+    // ranked exemplar, so a query's own named entity recurring across
+    // exemplars ("Shakespeare" in Hamlet+Macbeth+…) is wrongly classified as
+    // frame — measured live, it silently disqualified C3's genuine analog.
+    const namedByQuery = (c) => {
+        if (c.point !== null)
+            return true;
+        const bytes = read(ctx, c.anchor);
+        return c.src.runs.some((r) => r.qe - r.qs >= 2 * quantum &&
+            indexOf(bytes, query.subarray(r.qs, r.qe), 0) >= 0);
+    };
+    // Whether any committed root's consensus vote clears the SAME trust bar
+    // recallByResonance applies before grounding through a climb root:
+    // consensusFloor(N) = ln(N) + 1/2.  The climb's FIRST root is
+    // deliberately floor-free (attention.ts: "the dominant one always
+    // grounds") — fine for ORIENTING mechanisms, not for voicing learnt
+    // content the query never asked about.  Computed once here; both the
+    // hub fallback below and the comparison gate consume it.
+    const rootTrusted = roots.some((r) => r.vote >= consensusFloor(corpusN(ctx)));
     for (const c of analogs) {
-        const sim = await analogyStrength(ctx, dominant.anchor, c.anchor);
+        const { score: sim, halo } = await analogyStrength(ctx, dominant.anchor, c.anchor);
         ctx.trace?.step("tryAnalog", [
             rNode(ctx, dominant.anchor, "dominant"),
             rNode(ctx, c.anchor, "candidate", sim),
-        ], [], `analogy strength ${sim.toFixed(4)}`);
+        ], [], `analogy strength ${sim.toFixed(4)}${halo ? " (halo tier)" : ""}`);
         if (sim > bestSim) {
             bestSim = sim;
             bestAnalog = c;
+            bestHalo = halo;
         }
     }
     // When every candidate fails the similarity gates (halo company — now
@@ -372,6 +462,18 @@ export async function counterfactualTransfer(ctx, query, pre) {
         let hubMass = -1;
         const fanClamp = hubBound(ctx) + 1;
         for (const c of analogs) {
+            // A fallback comparison carries NO similarity evidence at all.  Its
+            // honesty rests on the grounding decider discounting it against
+            // richer candidates (the design note below) — an assumption that
+            // holds only when the climb itself settled on this query with real
+            // evidence.  Under a root the consensus floor does not trust, an
+            // unnamed, hop-reached hub is pure corpus adjacency: refusing it is
+            // what kept the live wrong echo silent.  A hub the query itself
+            // NAMED stays eligible either way (test/29 C2/C3's "William
+            // Shakespeare"); an unnamed one under a TRUSTED root stays eligible
+            // too (test/33 1b's deliberately weak second candidate).
+            if (!rootTrusted && !namedByQuery(c))
+                continue;
             // Evidence clamped at the hub bound: beyond √N + 1 the exact fan-out
             // no longer discriminates (every mega-hub ties at the clamp), and
             // counting it exactly would require the corpus-sized read.
@@ -412,17 +514,130 @@ export async function counterfactualTransfer(ctx, query, pre) {
     // climb's own forest, never tuned; substitution/redirection stay
     // unaffected — they orient around a displaced seat, not a whole-topic
     // analogy.
+    //
+    // roots.length <= 1 is a PROXY for "the query is about one thing" — it is
+    // only as good as the climb's own root-commitment, which depends on
+    // recognise() having found something to commit a root TO.  When the
+    // query's newest content genuinely isn't recognised (not boundary noise —
+    // real, uncommitted content; see the session's own investigation of the
+    // France→Spain live trace), the climb under-commits roots and this proxy
+    // is fooled: comparison looks licensed to treat the query as one topic
+    // when it is not.
+    //
+    // The direct check is the SAME accounted spans comparison is about to
+    // cite as its evidence: unexplainedSpans (rationale.ts, the same gap
+    // computation the trace's own `unexplained` diagnostic uses) names every
+    // stretch of the query NEITHER the dominant NOR the analog's evidence
+    // touches.  A short comparison query ("How is ice like steel?") legitimately
+    // accounts for only its two short entity spans — the surrounding "How is
+    // ... like ...?" framing is real but SHORT, split into several small gaps,
+    // none of them the bulk of the query.  The live bug's shape is different in
+    // kind, not degree: ONE contiguous, substantial gap — a whole second
+    // question the query added that comparison's two spans never touch at all.
+    //
+    // Two bars, both derived, neither tuned:
+    //   • the largest gap must not DOMINATE the whole query (the same
+    //     predicate CAST's own frame gate uses) — rules out a gap that is
+    //     most of the query outright;
+    //   • the largest gap must be SMALLER than the dominant's own established
+    //     context.  A gap can't be dismissed as mere connective framing once
+    //     it is at least as large as the topic being compared FROM — at that
+    //     scale it isn't glue between two named things, it's substantial
+    //     enough to be a second topic in its own right.  This is what
+    //     actually separates the live bug (a 47-byte gap against a 30-byte
+    //     dominant — the ignored content is bigger than the topic itself)
+    //     from ordinary short comparisons (a 9-byte gap against an 11-byte
+    //     dominant — the gap is smaller than what's being compared): the two
+    //     cases land on the same side of "half the query" often enough
+    //     (both can exceed or clear it) that the query-relative bar alone
+    //     does not reliably separate them — the topic-relative scale does.
+    const cmpAccounted = bestAnalog !== null
+        ? [...runSpans(dominant), ...runSpans(bestAnalog.point ?? bestAnalog.src)]
+        : [];
+    const cmpGaps = unexplainedSpans(query.length, cmpAccounted);
+    const cmpMaxGap = cmpGaps.reduce((n, [s, e]) => Math.max(n, e - s), 0);
+    // An analog that is not itself a directly ALIGNED point (point !== null —
+    // its own runs are query bytes, the query NAMED it) was only reached
+    // through a continuation hop or the structural-hub fallback.  Voicing
+    // learnt content the query never named is the same act recallByResonance
+    // refuses to perform through a climb root whose consensus vote is below
+    // consensusFloor(N) = ln(N) + 1/2 (recall.ts's minVote), so comparison
+    // holds the climb to that SAME bar before citing a hop-reached analog:
+    // some committed root must clear the floor.  The climb's FIRST root is
+    // deliberately floor-free (attention.ts: "the dominant one always
+    // grounds") — fine for ORIENTING mechanisms, not for transferring
+    // unnamed content through.  The live bug this gates (real trained store,
+    // 325k edge sources, floor 13.2): the query's stopword scraps pooled a
+    // 1.92 vote that committed an unrelated haiku exemplar as the sole root,
+    // and comparison voiced that exemplar's continuation through a
+    // hop-reached analog while every other mechanism honestly refused.  A
+    // directly aligned analog needs no floor — the query's own bytes are its
+    // evidence (test/29 C1's "Steel is hard" for "How is ice like steel?").
+    // See test/50-cast-analog-consensus-floor.
+    // A HALO-tier best analog needs neither: its similarity already cleared
+    // significanceBar-gated distributional company (analogyStrength's
+    // `halo`) — genuine evidence in its own right, the very case the halo
+    // gate exists for (test/33 1b's nickname-corroborated analog).  Only a
+    // FRAME-tier or fallback analog — whose "similarity" is an unbarred
+    // coverage fraction or nothing — needs the query's naming or the climb's
+    // trust.
+    const analogNamed = bestAnalog !== null && namedByQuery(bestAnalog);
+    // NOTE — two further gates were tried here and empirically REFUTED,
+    // recorded so they are not re-tried:
+    //   • dominant self-coverage (dominant's aligned runs must dominate its
+    //     own ctx): legitimate dominants sit at the same coverage as junk
+    //     ones ("The Mona Lisa was painted by…" 16/47 vs the live junk
+    //     haiku ~10/54) — no separation.
+    //   • denying the shared-frame similarity tier to hop-reached analogs:
+    //     semantically right in isolation, but it merely promoted the next
+    //     junk candidate — an ALIGNED scrap-matched point ("The affluence…",
+    //     frame 0.157) — into bestAnalog on the live store, and the aligned
+    //     configuration is byte-structurally IDENTICAL to test/29 C1's
+    //     legitimate one ("Steel is hard", frame 0.364): every derived
+    //     local separator measured (run length, site overlap, frame
+    //     query-containment, weave-usable classification) falls on the same
+    //     side for both.  Only corpus-scale consensus separates them, which
+    //     is exactly what `rootTrusted` prices.
+    // FRAME-tier evidence under an UNTRUSTED root is comparison's weakest
+    // licence (an unbarred coverage fraction, a climb the consensus floor
+    // does not trust).  There it is additionally held to the IGNORED-KNOWN
+    // principle (dismissedKnownContent, bridge.ts): the two analogs' aligned
+    // runs must account for every STORED window of the query.  This is the
+    // byte-structural separator the refuted-gates note below could not find
+    // locally: a legitimate small-corpus comparison ("How is ice like
+    // steel?") leaves only UNATTESTED spans ("How ", " like ") unexplained,
+    // while a scrap-matched junk pair leaves the query's own trained content
+    // ("…songs…times…", "…planet…sun.") dismissed as gaps.  Halo-tier and
+    // trusted-root comparisons are exempt — their evidence already stands.
+    const cmpDismisses = !(bestHalo || rootTrusted) &&
+        dismissedKnownContent(ctx, query, cmpAccounted);
     if (bestAnalog !== null &&
+        (bestHalo || analogNamed || rootTrusted) &&
+        !cmpDismisses &&
         dominant.ctx.length <= query.length &&
-        roots.length <= 1) {
+        roots.length <= 1 &&
+        !dominates(cmpMaxGap, query.length) &&
+        cmpMaxGap < dominant.ctx.length) {
         ctx.trace?.step("validateAnalogy", [
             rNode(ctx, dominant.anchor, "analog", bestSim),
             rNode(ctx, bestAnalog.anchor, "analog", bestSim),
         ], [], "the two structures keep distributional company beyond chance — genuine analogs");
         const a = await seatOf(dominant);
+        // The analog is only being CITED for comparison — the query never asked
+        // about it — so its seat never chases a FORWARD continuation (see
+        // seatOfNode's `allowForward`): only reverse (if a predecessor genuinely
+        // establishes it) or its own bytes.  A DIRECTLY aligned point
+        // (bestAnalog.point !== null) still goes through seatOfNode for that
+        // reverse check (a bare entity NAME like "Leonardo da Vinci" needs it —
+        // test/29's C2/C3).  A nextOf DESCENDANT (point === null) was already
+        // reached by following ONE meaningful hop off another aligned point (the
+        // alignment loop above: "its nextOf is the hub... and the hub's own
+        // [...] context will be the seat") — its own bytes ARE that seat
+        // directly, with no predecessor to even check (it was found by a
+        // forward edge, not matched in the query).
         const b = bestAnalog.point !== null
-            ? await seatOf(bestAnalog.point)
-            : await seatOfNode(bestAnalog.anchor, read(ctx, bestAnalog.anchor));
+            ? await seatOf(bestAnalog.point, false)
+            : read(ctx, bestAnalog.anchor);
         const answer = await joinWithBridge(ctx, a, b);
         record(answer, "analogical comparison — each analog voiced by the context that establishes its role", new Set([dominant.anchor, bestAnalog.anchor]), 
         // A halo-mediated act (the analogy gate) plus two seat projections.
@@ -432,10 +647,26 @@ export async function counterfactualTransfer(ctx, query, pre) {
         // when it was an aligned point, else the source point whose
         // continuation edge reached it (that alignment IS the query evidence
         // the hop rests on).
-        [
-            ...runSpans(dominant),
-            ...runSpans(bestAnalog.point ?? bestAnalog.src),
-        ]);
+        cmpAccounted);
+    }
+    else if (bestAnalog !== null &&
+        dominant.ctx.length <= query.length &&
+        roots.length <= 1) {
+        ctx.trace?.step("validateAnalogy", [
+            rNode(ctx, dominant.anchor, "analog", bestSim),
+            rNode(ctx, bestAnalog.anchor, "analog", bestSim),
+        ], [], !(bestHalo || analogNamed || rootTrusted)
+            ? `the best analog carries no halo-tier company evidence, was never ` +
+                `named by the query, and no committed root's consensus vote ` +
+                `clears the floor, so comparison refuses to voice it`
+            : cmpDismisses
+                ? `a frame-tier analog under an untrusted root dismisses stored ` +
+                    `query content its alignment never accounted for — comparison ` +
+                    `refuses to ignore what the store knows`
+                : `comparison's own accounted evidence leaves a ${cmpMaxGap}-byte gap in ` +
+                    `a ${query.length}-byte query against a ${dominant.ctx.length}-byte ` +
+                    `dominant — too large to be mere framing — so it refuses rather ` +
+                    `than paper over it with an analog the query never asked about`);
     }
     t?.done(results.map((r) => rItem(r.bytes, "answer")), results.length > 0
         ? `${results.length} counterfactual schema(s) fired — the grounding decider weighs them`

package/dist/src/mind/mechanisms/cover.js

@@ -8,12 +8,11 @@
 // cover runs FIRST in defaultMechanisms: a computed-backed cover becomes a
 // near-zero-cost incumbent that prunes the other mechanisms through the
 // ordinary admissible-floor check, with no extension special-case anywhere.
-import { bytesEqual, indexOf } from "../../bytes.js";
 import { read, resolve } from "../primitives.js";
 import { guidedFirst } from "../traverse.js";
 import { conceptHop } from "../match.js";
 import { bridge } from "../resonance.js";
-import { liftAnswer } from "../types.js";
+import { liftAnswer, segRestatesQuery } from "../types.js";
 import { decodeText, unexplainedLabel } from "../rationale.js";
 import { rItem, rNode, traceDerivation } from "../trace.js";
 // ── Concept / connector pre-resolution ──────────────────────────────────────
@@ -166,46 +165,32 @@ export const coverMechanism = {
             : "lightest derivation: the chosen spans, left to right");
         if (segs === null)
             return [];
+        const W = ctx.space.maxGroup;
         // A chosen span's SUBSTITUTED bytes (an edge followed from a recognised
         // site, not the site's own literal text read back) that equal a byte
         // span the query ALREADY CONTAINS elsewhere restates part of the
-        // question — never an answer (the same principle recall.ts's tiers
-        // apply to a whole-query projection: "a projection that is a proper
-        // byte-subspan of the query restates part of the question").  A
+        // question — never an answer (see {@link segRestatesQuery}).  A
         // recognised site that is itself an entire PRIOR TURN of a multi-turn
         // query is exactly this shape: it carries a genuine learnt
         // continuation, but that continuation is something the asker already
-        // said moments later in the SAME query, not a new answer — the cover
-        // search has no notion of "turn" to gate this itself, so the check
-        // belongs here, over the derivation it already chose.
-        const W = ctx.space.maxGroup;
-        for (const s of segs) {
-            if (!s.rec)
-                continue;
-            const literal = s.j - s.i === s.bytes.length &&
-                bytesEqual(s.bytes, query.subarray(s.i, s.j));
-            if (literal)
-                continue;
-            // A span shorter than one river window is exactly the "ice"/"c"
-            // case: a chain hop's short terminal coincidentally recurring as a
-            // substring of an unrelated longer word.  Below the quantum, byte
-            // overlap is chance, not evidence — the same floor identityBar and
-            // reachThreshold hold every other structural-overlap claim to.
-            if (s.bytes.length >= W && s.bytes.length < query.length &&
-                indexOf(query, s.bytes, 0) >= 0) {
-                ctx.trace?.step("restatedSpan", [rItem(s.bytes, "substituted", s.node, [s.i, s.j])], [], "the chosen span's substitution already occurs elsewhere in the query — restates it, not an answer");
-                return [];
-            }
+        // said moments later in the SAME query.  liftAnswer TRIMS such spans
+        // out of both the framing decision and the final concatenation — the
+        // OTHER spans a derivation chose are independent evidence and must not
+        // be discarded along with the stale one.
+        const restated = segs.filter((s) => segRestatesQuery(s, query, query.length, W));
+        if (restated.length > 0) {
+            ctx.trace?.step("restatedSpan", restated.map((s) => rItem(s.bytes, "substituted", s.node, [s.i, s.j])), [], "the chosen span's substitution already occurs elsewhere in the query — trimmed from the answer, not an answer itself");
         }
-        const composed = liftAnswer(segs, query.length);
+        const composed = liftAnswer(segs, query.length, query, W);
         if (composed === null)
             return [];
         ctx.trace?.step("liftAnswer", segs.map((s) => rItem(s.bytes, s.rec ? "chosen" : "scaffolding", s.node, [s.i, s.j])), [rItem(composed, "answer", resolve(ctx, composed) ?? undefined)], "lift the recognised region out of the asker's framing", tCover ? [tCover.index] : undefined);
-        // accounted = RECOGNISED cover spans only — PASS-carried bytes
-        // are priced in cost already; the diagnostic label reflects the
-        // same distinction.
+        // accounted = RECOGNISED, non-restating cover spans only — a trimmed
+        // restated span contributes nothing to the composed answer, so it must
+        // not be priced as if it did (PASS-carried bytes are priced already;
+        // the diagnostic label reflects the same distinction).
         const accounted = segs
-            .filter((s) => s.rec)
+            .filter((s) => s.rec && !segRestatesQuery(s, query, query.length, W))
             .map((s) => [s.i, s.j]);
         return [{
                 bytes: composed,

package/dist/src/mind/mechanisms/recall.js

@@ -12,6 +12,7 @@ import { follow, project, reverseContext } from "../match.js";
 import { CONCEPT, STEP } from "../graph-search.js";
 import { unexplainedLabel } from "../rationale.js";
 import { rItem, rNode } from "../trace.js";
+import { substitutionBridge } from "../bridge.js";
 /** Recall the answer by resonating the whole query against the content index. */
 export async function recallByResonance(ctx, query, pre) {
     const t = ctx.trace?.enter("recallByResonance", [
@@ -209,6 +210,71 @@ export async function recallByResonance(ctx, query, pre) {
             }
         }
     }
+    // 3b. Corroborated-substitution bridge — refusal-path only (bridge.ts).
+    // Every gist-based tier has failed; before refusing, align the query
+    // byte-for-byte against the trained contexts its own stored windows
+    // anchor, accepting mismatches only as corpus-attested, concept-bar
+    // substitutions.  A bridged context grounds exactly like any hit —
+    // projected through its learnt edges — under the same restated-fragment
+    // guard tiers 0b/2 apply.  Costs nothing on any answering path.
+    {
+        // The resonance hits already ranked above are handed to the bridge as
+        // PROPOSED candidates alongside its own anchor climbs: on a corpus this
+        // size a W-byte window is far too common for the clamped climb to
+        // single out the right trained context, while the whole-query gist
+        // already ranked it nearest (observed live: "what is the capital of
+        // france" resonating straight to "What is the capital of France?" yet
+        // refusing on the reach bar).  Approximate scores propose; the bridge's
+        // byte-exact alignment and attestation gates decide.
+        //
+        // The proposal breadth here is widened PAST `k` — first by requesting
+        // hubBound(ctx) candidates instead of `k` (recall's own tiers above
+        // stay at `k`; this re-resonates only on the refusal path, exactly
+        // where the bridge itself already runs), AND by asking the index to
+        // search EXHAUSTIVELY.  Both matter: the IVF only ever probes
+        // ⌈√clusters⌉ of them (store.ts's efFor) REGARDLESS of k — widening k
+        // alone just returns more hits from the SAME already-probed clusters,
+        // never a hit whose vector lives in an unprobed one.  Measured live:
+        // "What is the chemical symbol for water?" needs "What is the
+        // chemical formula for water?", scoring only 0.58 against the
+        // query's gist (a MIDDLE-of-string word swap perturbs the river-fold
+        // tree hash far more than a same-length TAIL swap like the "carbon"/
+        // "oxygen" neighbours that outrank it at 0.87+) — absent from the
+        // resonance list even at k=5000, present and byte-exact-verified the
+        // moment it's force-fed to the bridge directly.  `exhaustive` is the
+        // natural, tuning-free ceiling (probe every cluster) for a call that
+        // is ALREADY refusal-path-only and must not miss a candidate hiding
+        // behind an unlucky structural distance.
+        const wide = k < hubBound(ctx)
+            ? await ctx.store.resonate(queryGist, hubBound(ctx), true)
+            : whole;
+        const bridged = await substitutionBridge(ctx, query, wide.map((h) => h.id));
+        if (bridged !== null) {
+            const g = await project(ctx, bridged.id, queryGist);
+            // A projection contained in a substituted candidate-side span is the
+            // substitution RESTATED as if it were knowledge — the exact failure
+            // observed live: "Darwin was born in England." bridged to the
+            // Einstein fact through " England." → " Germany." and would have
+            // voiced "Germany", an answer the substitution itself manufactured.
+            // The same principle as the restated-fragment guards above, extended
+            // to the bridge's own substitutions.
+            const cBytes = ctx.store.bytes(bridged.id);
+            const manufactured = g !== null &&
+                bridged.subs.some((s) => indexOf(cBytes.subarray(s.cs, s.ce), g, 0) >= 0);
+            if (g !== null && g.length > 0 && !restates(g) && !manufactured &&
+                !(g.length < query.length && indexOf(query, g, 0) >= 0)) {
+                return ground(g, `substitution bridge — a trained context accounts for the query ` +
+                    `up to ${bridged.subs.length} corroborated substitution(s)`, 
+                // Accounted NOTHING — the same epistemic humility as the echo
+                // tier below: a substitution-bridged grounding is a last resort
+                // that must lose to ANY mechanism that actually explained the
+                // query (observed: pricing the aligned spans here outweighed
+                // extraction's correct answer in the grounding decider), while
+                // still beating silence when everything else refused.
+                [], CONCEPT * bridged.subs.length + STEP);
+            }
+        }
+    }
     // The refusal/echo decision.  The echo returns a stored form's bytes AS
     // the answer — a near-identity claim about the query — and identity-grade
     // decisions are never made on an estimated score ("approximate scores may

package/dist/src/mind/reasoning.d.ts

@@ -1,5 +1,16 @@
 import type { MindContext } from "./types.js";
 import type { Precomputed } from "./pipeline-mechanism.js";
+/** Whether `bytes` is a proper byte-subspan of `query` — already present in
+ *  the question, so voicing it back only restates part of what was asked,
+ *  never answers it.  The exact guard recallByResonance already applies to
+ *  its OWN grounding candidates (tier 1's `restates`, tier 2's subspan
+ *  check, tier 0b's argument-binding subspan check) — every mechanism that
+ *  walks a LEARNT CONTINUATION EDGE past an already-vetted grounding
+ *  (reason()'s own hops below, and CAST's `projectCounterfactual` seat
+ *  substitution — see cast.ts) needs the same guard applied to what the
+ *  walk turns up, since `follow()`/`chooseNext`/`pivotInto` know nothing of
+ *  the query at all — only of what structurally continues what. */
+export declare function restatesQuery(query: Uint8Array, bytes: Uint8Array): boolean;
 /** Extend a grounded answer forward across facts (multi-hop reasoning).
  *  Pivots on the longest unconsumed learnt context each answer contains,
  *  then follows the pivot's continuation to the next fact.  Repeats up