@hviana/sema 0.4.7 → 0.5.1

package/dist/src/mind/primitives.d.ts

@@ -6,6 +6,17 @@ import type { Input, MindContext } from "./types.js";
  *  (windows, regions, candidate spans), so key construction is far cheaper
  *  than the river fold it deduplicates. */
 export declare function latin1Key(bytes: Uint8Array): string;
+/** The {@link perceive} memo key: the span's content PLUS the boundary set it
+ *  was folded under.  The tree is a function of BOTH — the same bytes fold
+ *  plainly with no boundaries and into a left-nested stable-prefix shape with
+ *  them — so a content-only key returns whichever shape was computed first.
+ *  That is exactly what happened: a conversation seeded its cumulative context
+ *  under the content key, and every later plain `perceive` of those bytes was
+ *  served the boundary tree instead (measured: respondTurn answered where
+ *  respond() on byte-identical input did not).  NUL separates the two parts —
+ *  the boundary rendering is digits and commas, so no content byte can forge
+ *  the split. */
+export declare function perceiveKey(bytes: Uint8Array, boundaries?: readonly number[]): string;
 /** Perceive input into a content-defined tree (the river fold).
  *  Deterministic — identical bytes always produce an identical tree.
  *
@@ -16,16 +27,24 @@ export declare function latin1Key(bytes: Uint8Array): string;
  *  boundaries are; the geometry never guesses them from the bytes. */
 export declare function perceive(ctx: MindContext, input: Input, leafAt?: (i: number) => number | null, lookup?: (ids: number[]) => number | null, boundaries?: readonly number[]): Sema;
 /** The DEPOSIT-shaped perceive.  Folds over the stream's own content cuts —
- *  bit-identical to what inference computes for the same bytes, and that
- *  train/inference agreement is load-bearing for exact recall.  An input that
- *  EXTENDS a previously deposited one is a conversation context grown by one
- *  turn; the cached prefix length IS the turn boundary (derived from the deposit
- *  sequence itself, never from a content convention) and joins the cut set, so
- *  the trained context node and the query's context subtree are the SAME node.
- *  Segment folds reuse across deposits ({@link stablePrefixFoldIncremental}) —
- *  O(turn) instead of O(context) per turn.  All of it is purely a cache: an
- *  evicted chain loses only the turn boundaries, and since the content cuts do
- *  not depend on the cache, the segments themselves are unchanged. */
+ *  bit-identical to what inference computes for the same bytes.  That
+ *  train/inference agreement is the whole contract: the trained context node
+ *  and the node `resolve(query)` reaches must be the SAME node, and the only
+ *  way to guarantee it is to give this function nothing extra to say.  It
+ *  imposes no boundaries, knows nothing about turns, and reads no convention
+ *  out of the bytes.
+ *
+ *  An input that EXTENDS a previously deposited one — a conversation context
+ *  grown by a turn, or a resumed replay — reuses that deposit's already-folded
+ *  content segments ({@link contentFoldIncremental}), so it costs O(new bytes)
+ *  instead of O(context).  The reuse is TRANSPARENT by construction: a segment
+ *  is a pure function of its own bytes, so a reused one is bit-identical to a
+ *  refolded one.  Nothing has to prove that the extending deposit is "really"
+ *  a next turn — a coincidental byte prefix reuses the same segments and gets
+ *  the same tree it would have got anyway.  (It used to matter: while this
+ *  path imposed turn BOUNDARIES, a wrong guess changed the tree, so the cache
+ *  needed a continuation-bytes proof to gate it.  Nothing is imposed now, so
+ *  there is nothing to gate.) */
 export declare function perceiveDeposit(ctx: MindContext, bytes: Uint8Array, conversational?: boolean): Sema;
 /** The raw bytes of an input — modality-neutral conversion. */
 export declare function inputBytes(ctx: MindContext, input: Input): Uint8Array;

package/dist/src/mind/primitives.js

@@ -2,7 +2,7 @@
 //
 //   Address  — bytes → node   (perceive, foldTree, resolve)
 //   Read     — node → bytes   (read)
-import { bytesToTree, gridToTree, hilbertBytes, stablePrefixFoldIncremental, stackGrids, } from "../geometry.js";
+import { bytesToTree, contentFoldIncremental, gridToTree, hilbertBytes, stackGrids, } from "../geometry.js";
 import { canonHash } from "../canon.js";
 import { bytesEqual } from "../bytes.js";
 import { ALL } from "./types.js";
@@ -21,6 +21,22 @@ export function latin1Key(bytes) {
     }
     return s;
 }
+/** The {@link perceive} memo key: the span's content PLUS the boundary set it
+ *  was folded under.  The tree is a function of BOTH — the same bytes fold
+ *  plainly with no boundaries and into a left-nested stable-prefix shape with
+ *  them — so a content-only key returns whichever shape was computed first.
+ *  That is exactly what happened: a conversation seeded its cumulative context
+ *  under the content key, and every later plain `perceive` of those bytes was
+ *  served the boundary tree instead (measured: respondTurn answered where
+ *  respond() on byte-identical input did not).  NUL separates the two parts —
+ *  the boundary rendering is digits and commas, so no content byte can forge
+ *  the split. */
+export function perceiveKey(bytes, boundaries) {
+    const k = latin1Key(bytes);
+    return boundaries === undefined || boundaries.length === 0
+        ? k
+        : k + "\u0000" + boundaries.join(",");
+}
 /** Perceive input into a content-defined tree (the river fold).
  *  Deterministic — identical bytes always produce an identical tree.
  *
@@ -41,7 +57,7 @@ export function perceive(ctx, input, leafAt, lookup, boundaries) {
             // The tree is shared by reference; Sema nodes are never mutated.
             const memo = ctx.perceiveMemo;
             if (memo) {
-                const key = latin1Key(bytes);
+                const key = perceiveKey(bytes, boundaries);
                 const hit = memo.get(key);
                 if (hit !== undefined) {
                     if (ctx.meter)
@@ -70,67 +86,42 @@ export function perceive(ctx, input, leafAt, lookup, boundaries) {
     return gridToTree(ctx.space, ctx.alphabet, input);
 }
 /** The DEPOSIT-shaped perceive.  Folds over the stream's own content cuts —
- *  bit-identical to what inference computes for the same bytes, and that
- *  train/inference agreement is load-bearing for exact recall.  An input that
- *  EXTENDS a previously deposited one is a conversation context grown by one
- *  turn; the cached prefix length IS the turn boundary (derived from the deposit
- *  sequence itself, never from a content convention) and joins the cut set, so
- *  the trained context node and the query's context subtree are the SAME node.
- *  Segment folds reuse across deposits ({@link stablePrefixFoldIncremental}) —
- *  O(turn) instead of O(context) per turn.  All of it is purely a cache: an
- *  evicted chain loses only the turn boundaries, and since the content cuts do
- *  not depend on the cache, the segments themselves are unchanged. */
+ *  bit-identical to what inference computes for the same bytes.  That
+ *  train/inference agreement is the whole contract: the trained context node
+ *  and the node `resolve(query)` reaches must be the SAME node, and the only
+ *  way to guarantee it is to give this function nothing extra to say.  It
+ *  imposes no boundaries, knows nothing about turns, and reads no convention
+ *  out of the bytes.
+ *
+ *  An input that EXTENDS a previously deposited one — a conversation context
+ *  grown by a turn, or a resumed replay — reuses that deposit's already-folded
+ *  content segments ({@link contentFoldIncremental}), so it costs O(new bytes)
+ *  instead of O(context).  The reuse is TRANSPARENT by construction: a segment
+ *  is a pure function of its own bytes, so a reused one is bit-identical to a
+ *  refolded one.  Nothing has to prove that the extending deposit is "really"
+ *  a next turn — a coincidental byte prefix reuses the same segments and gets
+ *  the same tree it would have got anyway.  (It used to matter: while this
+ *  path imposed turn BOUNDARIES, a wrong guess changed the tree, so the cache
+ *  needed a continuation-bytes proof to gate it.  Nothing is imposed now, so
+ *  there is nothing to gate.) */
 export function perceiveDeposit(ctx, bytes, conversational = false) {
+    // Longest cached PROPER prefix first — the most segments to reuse.
     let prev;
-    let prefixLen = 0;
-    // Cache consult (both boundary lookup and stable-prefix reuse) is scoped
-    // to conversational deposits only — a bare, unrelated fact whose bytes
-    // happen to extend an earlier deposit is NOT a conversation turn, and
-    // must keep the plain fold so it shares structure with ITS OWN prior
-    // deposits, not fragment against a coincidental byte-prefix.
-    if (conversational) {
-        // Longest cached PROPER prefix first.
-        const lens = [...ctx._depositLens]
-            .filter((L) => L >= 2 && L < bytes.length)
-            .sort((a, b) => b - a);
-        for (const L of lens) {
-            const hit = ctx._depositTrees.get(latin1Key(bytes.subarray(0, L)));
-            // The suffix must bytes-equal the hit's OWN recorded continuation —
-            // proof this deposit is that turn's actual next turn, not a fact
-            // that coincidentally shares its byte prefix.
-            if (hit !== undefined && hit.nextBytes !== undefined &&
-                bytesEqual(hit.nextBytes, bytes.subarray(L))) {
-                prev = hit;
-                prefixLen = L;
-                break;
-            }
+    const lens = [...ctx._depositLens]
+        .filter((L) => L >= 2 && L < bytes.length)
+        .sort((a, b) => b - a);
+    for (const L of lens) {
+        const hit = ctx._depositTrees.get(latin1Key(bytes.subarray(0, L)));
+        if (hit !== undefined) {
+            prev = hit.content;
+            break;
         }
     }
-    // ONLY turn boundaries belong here.  The stream's own content cuts are NOT
-    // passed in: `bytesToTree` and `stablePrefixFoldIncremental` both derive them
-    // per span, at every level, and handing the level-0 cuts in as stable-prefix
-    // boundaries instead produces a LEFT-NESTED join of flat segments — a
-    // different tree from the one inference builds for the same bytes.  When that
-    // happened, a deposit's context root and `resolve(question)` were different
-    // nodes, so the trained edge hung off a node inference never reached and
-    // recall went silent (test/44 caught it as a site that could not be emitted
-    // because the resolved node led nowhere).  Train and infer must fold
-    // identically; the way to guarantee that is to give this function nothing
-    // extra to say.
-    const cuts = new Set();
-    if (prev !== undefined) {
-        for (const b of prev.boundaries)
-            cuts.add(b);
-        cuts.add(prefixLen);
-    }
-    const boundaries = [...cuts].sort((a, b) => a - b);
-    const folded = stablePrefixFoldIncremental(ctx.space, ctx.alphabet, bytes, boundaries, prev?.stable);
-    const tree = folded.tree;
-    const entry = { boundaries, stable: folded.fold };
-    // Only a conversational deposit writes the cache too — otherwise a bare
-    // fact's plain fold could later be misread as a conversation's turn-zero
-    // boundary by an unrelated conversational deposit that happens to extend
-    // its bytes.
+    const folded = contentFoldIncremental(ctx.space, ctx.alphabet, bytes, prev);
+    // Only a CONVERSATIONAL deposit writes the cache: reuse is sound for any
+    // deposit, but the budget is 8 entries and a corpus of unrelated facts would
+    // evict the live chains for nothing.  Purely a cost decision now, not a
+    // correctness one.
     if (conversational && bytes.length >= 2) {
         // The lengths set drifts as the map evicts; past the probe budget the
         // drift itself becomes the cost (each stale length is an O(len) key
@@ -139,10 +130,10 @@ export function perceiveDeposit(ctx, bytes, conversational = false) {
             ctx._depositLens.clear();
             ctx._depositTrees.clear();
         }
-        ctx._depositTrees.set(latin1Key(bytes), entry);
+        ctx._depositTrees.set(latin1Key(bytes), { content: folded.fold });
         ctx._depositLens.add(bytes.length);
     }
-    return tree;
+    return folded.tree;
 }
 /** The raw bytes of an input — modality-neutral conversion. */
 export function inputBytes(ctx, input) {
@@ -164,20 +155,47 @@ export function gistOf(ctx, bytes) {
  *  node with its byte span and resolved id.  Returns the node's byte end and
  *  resolved id. */
 export function foldTree(ctx, n, start, visit) {
-    // Fast path: subtree already resolved (from a previous conversation turn
-    // or an earlier recognition pass).  The pyramid reuses prefix subtrees as
-    // identical Sema objects, so this cache turns foldTree into O(suffix)
-    // instead of O(context) for multi-turn recognition.
+    // Subtree already resolved (from a previous conversation turn or an earlier
+    // recognition pass).  The pyramid reuses prefix subtrees as identical Sema
+    // objects, so a conversation's prefix is warm from its second turn on.
+    // Without a visitor that makes foldTree O(suffix) instead of O(context);
+    // with one it stays O(context) and saves the per-node store probes instead
+    // (see below for why the distinction is not negotiable).
+    //
+    // WHAT THE CACHE KNOWS, AND WHAT IT DOES NOT.  An entry records this
+    // subtree's id and byte length — nothing about its DESCENDANTS' spans.
+    // Returning here therefore emits ONE visit() where a cold walk emits one per
+    // node, and `visit` is not instrumentation: recognise() emits its sites from
+    // it (recognition.ts) and attention's collectRegions votes over what it
+    // yields (attention.ts).  Skipping the descent silently shrinks the evidence
+    // those mechanisms see, purely because the cache happened to be warm.
+    //
+    // That is not hypothetical and not an edge case — it is every conversation
+    // turn after the first.  `contentFoldIncremental` deliberately shares prefix
+    // segment OBJECTS across turns (~99% reuse), so by turn 2 the prefix is
+    // warm; meanwhile recogniseMemo/climbMemo are keyed on exact query BYTES,
+    // which a growing context never repeats.  Warm subtrees + missed memos is
+    // the unprotected quadrant.  Measured over real trained conversations,
+    // recognising the same context with a warm prefix lost 67-92% of its leaves
+    // (772->204, 589->47, 872->291, 377->37) with `sites` unchanged, so the loss
+    // is invisible to the coarse counts; a direct foldTree probe on identical
+    // bytes and an identical tree object fired visit() 661 times cold and 37
+    // warm.  respond() is immune only because it never sets _resolvedSubtrees
+    // (mind.ts) — the degradation was unique to the multi-turn API.
+    //
+    // So the fast path is taken only when NOBODY IS WATCHING.  With a visitor
+    // present we still walk, and the cache degrades to the thing it soundly is:
+    // an elision of the store probes (findLeaf/findBranch) at each node, not an
+    // elision of the traversal.  Ids still come from the cache, so a warm walk
+    // is cheaper than a cold one; it is no longer *different* from one.
     const cached = ctx._resolvedSubtrees?.get(n);
-    if (cached !== undefined) {
-        const end = start + cached.len;
-        visit?.(n, start, end, cached.id);
-        return { end, node: cached.id };
+    if (cached !== undefined && visit === undefined) {
+        return { end: start + cached.len, node: cached.id };
     }
     if (n.kids === null) {
         const b = n.leaf ?? new Uint8Array(0);
         const end = start + b.length;
-        const node = ctx.store.findLeaf(b);
+        const node = cached !== undefined ? cached.id : ctx.store.findLeaf(b);
         visit?.(n, start, end, node);
         if (node !== null && ctx._resolvedSubtrees) {
             ctx._resolvedSubtrees.set(n, { id: node, len: b.length });
@@ -195,7 +213,16 @@ export function foldTree(ctx, n, start, visit) {
             kids.push(r.node);
         pos = r.end;
     }
-    const node = known ? ctx.store.findBranch(kids) : null;
+    // Same store-probe elision as the leaf case: a cached entry already names
+    // this subtree, so the descent above was for `visit`'s benefit alone and the
+    // id need not be re-derived.  Using it also keeps a warm walk's ids
+    // bit-identical to a cold walk's rather than re-deriving them from children
+    // that may themselves have come from cache.
+    const node = cached !== undefined
+        ? cached.id
+        : known
+            ? ctx.store.findBranch(kids)
+            : null;
     visit?.(n, start, pos, node);
     if (node !== null && ctx._resolvedSubtrees) {
         ctx._resolvedSubtrees.set(n, { id: node, len: pos - start });

package/dist/src/mind/recognition.js

@@ -8,6 +8,7 @@ import { rItem } from "./trace.js";
 import { canonResolve, foldTree, gistOf, latin1Key, perceive, resolve, } from "./primitives.js";
 import { atomIsHub, corpusN, leadsSomewhere } from "./traverse.js";
 import { chainReach, leafIdAt, leafIdRun } from "./canonical.js";
+import { canonHash } from "../canon.js";
 import { isChunk } from "../sema.js";
 /** Decompose a byte stream into every stored form that leads somewhere
  *  (has a continuation edge or a halo).  Two complementary readings:
@@ -25,23 +26,40 @@ export function recognise(ctx, bytes) {
     // Content-keyed memo — works for both single-turn respond() and multi-turn
     // respondTurn() (where the map persists across calls).  ALWAYS consulted,
     // regardless of tracing — matching perceive()'s own memo, which carries no
-    // trace gate at all.  This memo is NOT an optional accelerator: recogniseImpl
-    // walks the query's perceived tree via foldTree, whose subtree-resolution
-    // fast path (see primitives.ts) skips invoking `visit` — and therefore
-    // skips EMITTING SITES — for any subtree already cached in
-    // ctx._resolvedSubtrees.  A multi-turn conversation's stable-prefix fold
-    // deliberately shares node OBJECTS across turns, so by the second call on
-    // the exact same bytes, large swaths of the tree are already cached and
-    // foldTree stops short of recursing into them — a second recogniseImpl
-    // call on the SAME bytes is not idempotent; it silently finds FEWER sites
-    // than the first (observed live: 31 sites → 5 on an immediate repeat
-    // call).  Skipping this memo "only while tracing" used to mean every
-    // traced turn re-ran recogniseImpl from scratch at every one of the many
-    // call sites that recognise the same query (cover, reason, articulate...),
-    // each subsequent call silently more incomplete than the last — measurably
-    // changing which mechanism grounds the answer, not just costing time.  The
-    // trace step must still fire on every call regardless (a cache hit is not
-    // silent), so it is emitted here directly instead of only inside
+    // trace gate at all.
+    //
+    // This memo is an accelerator, and that is now the whole of it: repeated
+    // recognition of the same query is ordinary within one response (cover,
+    // reason and articulate all recognise it) and recogniseImpl is O(n ·
+    // maxGroup) probes each time.
+    //
+    // IT USED TO BE LOAD-BEARING FOR CORRECTNESS, and the history is worth
+    // keeping because it explains why there is no trace gate here.  foldTree's
+    // subtree-resolution fast path (primitives.ts) once returned on a cache hit
+    // WITHOUT recursing, so it skipped invoking `visit` — and therefore skipped
+    // EMITTING SITES — for any subtree already in ctx._resolvedSubtrees.  A
+    // conversation's incremental fold deliberately shares node OBJECTS across
+    // turns, so by the second call on the same bytes large swaths of the tree
+    // were already cached and recogniseImpl silently found FEWER sites than the
+    // first call (observed live: 31 → 5).  Skipping this memo "only while
+    // tracing" therefore meant every traced turn re-ran recogniseImpl at each of
+    // those call sites, each result more incomplete than the last — changing
+    // which mechanism grounded the answer, not merely costing time.
+    //
+    // foldTree no longer does that: it takes the fast path only when no `visit`
+    // is supplied, so a walk that emits sites always walks in full and the id
+    // cache is reduced to eliding store probes (see primitives.ts).  recognise()
+    // is idempotent on its own now — verified with the memo bypassed, the
+    // subtree cache warm and the tree object shared: three consecutive calls on
+    // the same 544-byte context returned sites=2 leaves=544 splits=0 starts=88,
+    // identical every time.
+    //
+    // The unconditional consult STAYS regardless.  A memo whose absence can only
+    // cost time is still not something to gate on whether an audit happens to be
+    // attached: tracing must not change what the pipeline computes, and the
+    // cheapest way to guarantee that is for the trace flag to touch nothing but
+    // the trace.  The trace step must still fire on every call (a cache hit is
+    // not silent), so it is emitted here directly rather than only inside
     // recogniseImpl.
     if (ctx.recogniseMemo) {
         const key = latin1Key(bytes);
@@ -400,7 +418,21 @@ function recogniseImpl(ctx, bytes) {
     // before resolveSpan pays for a fold; approximate evidence never enters.
     // This tier is needed only where atom chains are suppressed. Small stores
     // retain their existing decomposition unchanged.
-    if (atomsAreHubs) {
+    // ALWAYS ON, AND LINEAR.  This used to be gated on `atomsAreHubs` — small
+    // stores were said to "retain their existing decomposition unchanged", which
+    // was true only while the query's fold was told where the turns were: every
+    // turn was then a NODE, so the structural walk found it and this tier had
+    // nothing to add.  The fold no longer imposes turn boundaries (a turn start
+    // is an ordinary interior offset now), so a trained form embedded in a
+    // longer query is reachable ONLY here — the chain caps at chainReach(W)=W²
+    // bytes and cannot span one.  Measured: with the fold imposing boundaries
+    // every turn is a node; without it, none is.
+    //
+    // Ungating it alone made inference QUADRATIC (test/14's constant-KB/s guard
+    // went to 41.8s): every offset near a cut is an endpoint, and each probe
+    // costs O(span) to slice the leaf-id run and hash it.  The budget below is
+    // what makes it affordable — see `spend`.
+    {
         const allLeafIds = singleLeaf.map((x) => x?.id ?? null);
         if (allLeafIds.every((x) => x !== null)) {
             const radius = ctx.space.seats.length;
@@ -410,20 +442,115 @@ function recogniseImpl(ctx, bytes) {
                     endpoints.add(p);
             }
             const ordered = [...endpoints].sort((a, b) => a - b);
-            const probe = (start, end) => {
+            // The leaf-id run is BYTE-EXACT, while `resolveSpan` behind it resolves
+            // exactly OR canonically — so this gate was strictly narrower than its
+            // own resolver, and every embedded form differing from its deposit only
+            // by the response's equivalence (case, width) was dropped before the
+            // resolver ever saw it.  Rebuilding the run over canonicalized bytes
+            // does NOT fix that: a differently-cased deposit's branch kid-ids are
+            // not the query's leaf-id run under ANY canonicalization of the query,
+            // so the second admission route has to be the canon INDEX itself — the
+            // same candidate proposal `canonResolve` makes, and the same
+            // cheap-probe-before-a-fold discipline the exact route already follows
+            // (a hash and an indexed lookup; no fold, no vector, no scan).  Both
+            // routes only PROPOSE; `resolveSpan` still decides, so a hash-bucket
+            // collision costs one fold and can never emit a wrong site (test/71).
+            const canonAdmits = (start, end) => {
+                const canon = ctx.canon;
+                if (canon === null || !store.canonFind)
+                    return false;
+                const key = canon(bytes.subarray(start, end));
+                if (key.length === 0)
+                    return false;
+                return store.canonFind(canonHash(key)).length > 0;
+            };
+            // The byte-exact route probes the SPAN ITSELF (see
+            // Store.findFlatBranch): for a run of single-byte leaves the flat-kid
+            // encoding is the identity, so the span's bytes ARE the branch key.
+            // `subarray` is a view — this allocates nothing per probe, and the
+            // bloom filter answers the misses without touching the database.
+            const flatProbe = (start, end) => store.findFlatBranch
+                ? store.findFlatBranch(bytes.subarray(start, end))
+                : store.findBranch(allLeafIds.slice(start, end));
+            // THE TWO ROUTES COST DIFFERENT THINGS, SO THEY ARE PRICED SEPARATELY.
+            //
+            // The exact route is a bloom-gated hash over a subarray VIEW: no
+            // allocation, and a miss never reaches the database.  It is cheap enough
+            // to run on every endpoint, and that is what makes this tier able to
+            // find a trained form embedded anywhere in the query.
+            //
+            // The canon route is not: it runs the canonicalizer over the span
+            // (NFKC, case-fold, whitespace) and allocates a fresh key for every
+            // probe.  That is the O(span) cost with the heavy constant, and it is
+            // the one worth a budget.  Sharing ONE budget between them made the
+            // cheap route starve on the expensive one's behalf — measured, test/71's
+            // embedded differently-cased form needed 64x the budget to be found,
+            // while the exact route it was competing with needed none of it.
+            const probe = (start, end, canonBudget) => {
                 if (end - start < W || end - start <= chainReach(W))
                     return;
-                const ids = allLeafIds.slice(start, end);
-                if (store.findBranch(ids) === null)
-                    return;
+                if (flatProbe(start, end) === null) {
+                    if (!canonBudget)
+                        return;
+                    if (!canonAdmits(start, end))
+                        return;
+                }
                 const id = resolveSpan(start, end);
                 if (id !== null)
                     emit(start, end, id);
             };
-            for (const end of ordered)
-                probe(0, end);
-            for (const start of ordered)
-                probe(start, bytes.length);
+            // A CUMULATIVE BYTE BUDGET, SPENT SHORTEST-SPAN-FIRST.
+            //
+            // Each probe costs O(span), and there are O(n) endpoints, so probing
+            // them all is O(n²) — the quadratic this tier was gated to avoid.  The
+            // budget caps TOTAL probe bytes at a multiple of the query's own length,
+            // which is what keeps whole-query inference linear.
+            //
+            // Spending it shortest-first is what makes the cap a scale bound rather
+            // than a position bound: the tier recovers embedded forms up to roughly
+            // √(2·budget) bytes ANYWHERE in the endpoint set, instead of walking the
+            // endpoints in order and running out partway along the query.  A form
+            // longer than that is out of this tier's reach — but so is a form the
+            // chain cannot span, and that is exactly the trade the budget prices.
+            // The factor is chainReach(W), the same W² scale the chain already
+            // trusts; no new constant.
+            // The factor is chainReach(W) — the same W² scale the chain itself
+            // trusts — so the cap is derived from the fold's geometry, never tuned.
+            // (It was briefly an environment variable while the cost was being
+            // measured; an env-read here would make inference non-reproducible,
+            // which the determinism contract forbids outright.)
+            // The factor is chainReach(W) — the same W² scale the chain itself
+            // trusts — so the cap is derived from the fold's geometry, never tuned.
+            // (It was briefly an environment variable while the cost was being
+            // measured; an env-read here would make inference non-reproducible,
+            // which the determinism contract forbids outright.)
+            //
+            // It now prices ONLY the canonicalizing route; the exact route runs on
+            // every endpoint regardless, so exhausting this budget narrows which
+            // equivalence-class forms are proposed, never which byte-exact ones.
+            let budget = bytes.length * chainReach(W) * chainReach(W);
+            const spend = (start, end) => {
+                const span = end - start;
+                const afford = span <= budget;
+                if (afford)
+                    budget -= span;
+                probe(start, end, afford);
+                // Always keep walking: the exact route is unbudgeted, so running out
+                // of canon budget must not stop the scan.
+                return true;
+            };
+            const prefixes = ordered.filter((e) => e > 0).sort((a, b) => a - b);
+            const suffixes = ordered
+                .filter((s2) => s2 < bytes.length)
+                .sort((a, b) => b - a);
+            for (let i = 0; i < Math.max(prefixes.length, suffixes.length); i++) {
+                // Interleaved so neither edge starves the other when the budget runs
+                // out — a query can carry a trained form at either end.
+                if (i < prefixes.length && !spend(0, prefixes[i]))
+                    break;
+                if (i < suffixes.length && !spend(suffixes[i], bytes.length))
+                    break;
+            }
         }
     }
     const chunkEnd = new Uint32Array(bytes.length);

package/dist/src/mind/traverse.d.ts

@@ -124,3 +124,35 @@ export declare function chooseAmong(ctx: MindContext, candidates: readonly numbe
     id: number;
     score: number;
 };
+/** True when NO window of `query` discriminates anything — every stored
+ *  W-window it spells is contained by more places than the hub bound allows,
+ *  i.e. the whole query is corpus-global scaffolding.
+ *
+ *  WHAT IT IS FOR.  Several mechanisms ground a query through the literal
+ *  spans it did NOT explain, and those spans are the whole of their evidence.
+ *  When every one of them is a hub, the query says nothing the corpus can be
+ *  held to, and grounding it means picking one of thousands of continuations
+ *  it gives no evidence for — a fabrication whatever the answer happens to be.
+ *  Answering with silence there is the honest degradation contract (§2.13).
+ *
+ *  MEASURED SEPARATION (trained store, hubBound 571) — this is categorical,
+ *  not marginal, and it is why the predicate lives here rather than being
+ *  spelled twice:
+ *    "What is the capital of"  ALL saturated ("What":572)  → fabricated
+ *    "What is the capital "    ALL saturated ("What":572)  → fabricated
+ *    "what is the capital of france"  min "f fr":248       → correct
+ *    "What is the capitol of France?" min "f Fr":114       → correct
+ *    "WHAT IS THE CAPITAL OF FRANCE?" min "HE C":1         → correct
+ *    "What  is   the capital  of France?" min "t  i":4     → correct
+ *    "Who wrote Romeo and Juliet?"    min "iet?":26        → correct
+ *    "What is the capital of Zamunda?" min "Zamu":3        → silent anyway
+ *  Note the last: the honest-silence probes are already refused on other
+ *  evidence and sit on the SAME side as the correct ones, so this predicate
+ *  is not what makes them silent and cannot be credited for them.
+ *
+ *  NO NEW THRESHOLD (§2.2): `hubBound` is the √N reading of "hub" used
+ *  everywhere, and the containment read is clamped to it exactly as every
+ *  other fan-out read is (§2.8).  A query with no stored window at all is NOT
+ *  scaffolding-only — it has no evidence either way, and its callers already
+ *  refuse it on their own terms. */
+export declare function allWindowsAreScaffolding(ctx: MindContext, query: Uint8Array): boolean;

package/dist/src/mind/traverse.js

@@ -7,6 +7,7 @@
 // project) live in match.ts — the elementary match-and-project operation.
 import { cosine } from "../vec.js";
 import { gistOf, read } from "./primitives.js";
+import { leafIdRun } from "./canonical.js";
 const structCaches = new WeakMap();
 // ── The shared ancestor-reach memo ──────────────────────────────────────
 //
@@ -648,3 +649,54 @@ function rItemShort(ctx, id, role, score) {
         score,
     };
 }
+/** True when NO window of `query` discriminates anything — every stored
+ *  W-window it spells is contained by more places than the hub bound allows,
+ *  i.e. the whole query is corpus-global scaffolding.
+ *
+ *  WHAT IT IS FOR.  Several mechanisms ground a query through the literal
+ *  spans it did NOT explain, and those spans are the whole of their evidence.
+ *  When every one of them is a hub, the query says nothing the corpus can be
+ *  held to, and grounding it means picking one of thousands of continuations
+ *  it gives no evidence for — a fabrication whatever the answer happens to be.
+ *  Answering with silence there is the honest degradation contract (§2.13).
+ *
+ *  MEASURED SEPARATION (trained store, hubBound 571) — this is categorical,
+ *  not marginal, and it is why the predicate lives here rather than being
+ *  spelled twice:
+ *    "What is the capital of"  ALL saturated ("What":572)  → fabricated
+ *    "What is the capital "    ALL saturated ("What":572)  → fabricated
+ *    "what is the capital of france"  min "f fr":248       → correct
+ *    "What is the capitol of France?" min "f Fr":114       → correct
+ *    "WHAT IS THE CAPITAL OF FRANCE?" min "HE C":1         → correct
+ *    "What  is   the capital  of France?" min "t  i":4     → correct
+ *    "Who wrote Romeo and Juliet?"    min "iet?":26        → correct
+ *    "What is the capital of Zamunda?" min "Zamu":3        → silent anyway
+ *  Note the last: the honest-silence probes are already refused on other
+ *  evidence and sit on the SAME side as the correct ones, so this predicate
+ *  is not what makes them silent and cannot be credited for them.
+ *
+ *  NO NEW THRESHOLD (§2.2): `hubBound` is the √N reading of "hub" used
+ *  everywhere, and the containment read is clamped to it exactly as every
+ *  other fan-out read is (§2.8).  A query with no stored window at all is NOT
+ *  scaffolding-only — it has no evidence either way, and its callers already
+ *  refuse it on their own terms. */
+export function allWindowsAreScaffolding(ctx, query) {
+    const W = ctx.space.maxGroup;
+    const bound = hubBound(ctx);
+    let sawOne = false;
+    for (let o = 0; o + W <= query.length; o++) {
+        const ids = leafIdRun(ctx, query, o, o + W);
+        if (ids === null)
+            continue;
+        const id = ctx.store.findBranch(ids);
+        if (id === null)
+            continue;
+        const rarity = ctx.store.containersSlice(id, 0, bound + 1).length;
+        if (rarity === 0)
+            continue;
+        if (rarity <= bound)
+            return false;
+        sawOne = true;
+    }
+    return sawOne;
+}