@hviana/sema 0.5.2 → 0.5.4

package/src/mind/bridge.ts

@@ -105,16 +105,13 @@ import {
 } from "./traverse.js";
 import { rItem, rNode } from "./trace.js";
 import { junctionContainersFrom } from "./junction.js";
-import { spanHalo } from "./match.js";
+import { alignAround, type AlignGap, spanHalo } from "./match.js";
 
 /** One accepted substitution: query span [qs,qe) stands in for the
- *  candidate context's span — recorded for the rationale trace. */
-interface Substitution {
-  qs: number;
-  qe: number;
-  cs: number;
-  ce: number;
-}
+ *  candidate context's span — recorded for the rationale trace.  The same
+ *  shape the shared aligner reports a disagreement as ({@link AlignGap}); an
+ *  accepted substitution is a gap that cleared this file's gates. */
+type Substitution = AlignGap;
 
 /** A bridged grounding proposal: the trained context to ground, the query
  *  spans its alignment accounts for, and the substitutions that closed it. */
@@ -151,102 +148,11 @@ export function dismissedKnownContent(
   return false;
 }
 
-/** Extend a seed match (query offset qo ↔ candidate offset co) to its
- *  maximal common run, then walk outward in both directions collecting
- *  further common runs of at least W bytes across bounded mismatch gaps
- *  (each side ≤ chainReach).  Returns the matched query spans and the
- *  mismatch pairs between consecutive runs. */
-function align(
-  ctx: MindContext,
-  q: Uint8Array,
-  c: Uint8Array,
-  qo: number,
-  co: number,
-): { matched: Array<[number, number]>; gaps: Substitution[] } {
-  const W = ctx.space.maxGroup;
-  const reachCap = chainReach(W);
-  // Maximal run around the seed.
-  let qs = qo, ss = co;
-  while (qs > 0 && ss > 0 && q[qs - 1] === c[ss - 1]) {
-    qs--;
-    ss--;
-  }
-  let qe = qo, se = co;
-  while (qe < q.length && se < c.length && q[qe] === c[se]) {
-    qe++;
-    se++;
-  }
-  const matched: Array<[number, number]> = [[qs, qe]];
-  const gaps: Substitution[] = [];
-  // The next common run of ≥ W bytes past (qi, si), with each side's gap
-  // bounded by chainReach; smallest total gap wins (nearest continuation).
-  const runLenAt = (qi: number, si: number): number => {
-    let n = 0;
-    while (qi + n < q.length && si + n < c.length && q[qi + n] === c[si + n]) {
-      n++;
-    }
-    return n;
-  };
-  // RIGHT sweep.
-  let qi = qe, si = se;
-  for (;;) {
-    let found = false;
-    for (let total = 1; total <= 2 * reachCap && !found; total++) {
-      for (let gq = 0; gq <= Math.min(total, reachCap); gq++) {
-        const gs = total - gq;
-        if (gs > reachCap) continue;
-        if (qi + gq >= q.length || si + gs >= c.length) continue;
-        const n = runLenAt(qi + gq, si + gs);
-        if (n >= W || qi + gq + n === q.length) {
-          if (n === 0) continue;
-          if (gq > 0 || gs > 0) {
-            gaps.push({ qs: qi, qe: qi + gq, cs: si, ce: si + gs });
-          }
-          matched.push([qi + gq, qi + gq + n]);
-          qi = qi + gq + n;
-          si = si + gs + n;
-          found = true;
-          break;
-        }
-      }
-    }
-    if (!found) break;
-  }
-  // LEFT sweep (mirror).
-  qi = qs;
-  si = ss;
-  for (;;) {
-    let found = false;
-    for (let total = 1; total <= 2 * reachCap && !found; total++) {
-      for (let gq = 0; gq <= Math.min(total, reachCap); gq++) {
-        const gs = total - gq;
-        if (gs > reachCap) continue;
-        if (qi - gq <= 0 || si - gs <= 0) continue;
-        // Run ENDING at (qi - gq, si - gs).
-        let n = 0;
-        while (
-          n < qi - gq && n < si - gs &&
-          q[qi - gq - 1 - n] === c[si - gs - 1 - n]
-        ) {
-          n++;
-        }
-        if (n >= W || n === qi - gq) {
-          if (n === 0) continue;
-          if (gq > 0 || gs > 0) {
-            gaps.push({ qs: qi - gq, qe: qi, cs: si - gs, ce: si });
-          }
-          matched.push([qi - gq - n, qi - gq]);
-          qi = qi - gq - n;
-          si = si - gs - n;
-          found = true;
-          break;
-        }
-      }
-    }
-    if (!found) break;
-  }
-  return { matched, gaps };
-}
+// The seeded aligner this file used to own now lives in the shared match
+// family as {@link alignAround} — the frame reading (match.ts) reads the same
+// gaps and asks the OPPOSITE question of them (see AlignGap's own doc).  Two
+// consumers, one definition (AGENTS §2.5); the bridge's reading is unchanged.
+const align = alignAround;
 
 /** Recall's corroborated-substitution bridge — see the module comment.
  *  Returns the best bridged grounding proposal, or null. */

package/src/mind/match.ts

@@ -18,19 +18,29 @@
 //                       direct or mutual-sibling)
 //   multi-hop pivot     byte containment               forward       —
 //   articulation        halo sibling                   substitute    conceptThreshold
+//   reference           frameSlots() (the shared       carry into    carriesFillers
+//                       aligner, gaps contracted)      the answer
 //
 // This module holds the shared vocabulary those configurations are built
-// from — the MATCHERS (locate, alignRuns, alignGraded, analogyStrength) and
-// the PROJECTIONS (follow, conceptHop, reverseContext, project) — so each
-// mechanism file states only its configuration, never its own copy of the
-// machinery.  The gates all live in geometry.ts (derived, never tuned).
+// from — the MATCHERS (locate, alignRuns, alignGraded, alignAround/frameSlots,
+// analogyStrength) and the PROJECTIONS (follow, conceptHop, reverseContext,
+// project) — so each mechanism file states only its configuration, never its
+// own copy of the machinery.  Most gates live in geometry.ts (derived, never
+// tuned); the two STRUCTURAL gates that are byte predicates rather than
+// thresholds — isSpanShaped and carriesFillers — live here beside the matchers
+// they gate.
 
 import { addInto, cosine, dot, normalize, Vec, zeros } from "../vec.js";
 import type { Hit } from "../store.js";
-import { conceptThreshold, identityBar, significanceBar } from "../geometry.js";
-import { indexOf } from "../bytes.js";
+import {
+  conceptThreshold,
+  dominates,
+  identityBar,
+  significanceBar,
+} from "../geometry.js";
+import { bytesEqual, indexOf } from "../bytes.js";
 import type { MindContext } from "./types.js";
-import { leafIdRun } from "./canonical.js";
+import { chainReach, leafIdRun } from "./canonical.js";
 import { foldTree, gistOf, perceive, read, resolve } from "./primitives.js";
 import {
   argmaxCosine,
@@ -294,6 +304,486 @@ export function alignGraded(
   return out;
 }
 
+// ═══════════════════════════════════════════════════════════════════════════
+// THE FRAME READING — variable positions, and the licence to voice through one
+// ═══════════════════════════════════════════════════════════════════════════
+//
+// Sema is otherwise a fully GROUND system: every item of the deduction system,
+// every matcher and every gate compares ground bytes.  Nothing anywhere
+// represents a POSITION whose occupant comes from the context rather than the
+// corpus, and so no mechanism can tell
+//
+//     "the corpus does not explain these bytes"   (PASS — refuse)
+//
+// apart from
+//
+//     "these bytes occupy a place the corpus keeps open"   (bind).
+//
+// Both arrive as unaligned residue.  That single missing distinction is why
+// the substitution bridge refuses on `attestedQ`, why the cover charges PASS
+// over a slot, and why CAST reads a filler as noise rather than as the
+// variable it is.  The family below supplies it, and it lives HERE — not in
+// any mechanism — because it is the ordinary (matcher, projection, gate)
+// triple of §2.5 with its three parts in their proper places:
+//
+//   matcher     alignAround + contractGap + frameSlots — bytes only, no
+//               projection, no licence.  SAFE FOR EVERY CONSUMER: knowing a
+//               span is variable can only improve an alignment.
+//   projection  follow / project — unchanged, already here.
+//   gate        carriesFillers — the licence to VOICE through a slot.  Needed
+//               only by a mechanism that voices, so it is deliberately NOT
+//               folded into the matcher.
+//
+// The split matters.  Slot detection is universal; the licence is not, and a
+// consumer that took the matcher's answer as permission to voice would be
+// making exactly the claim the licence exists to withhold.
+
+/** One place two byte streams DISAGREE, between runs where they agree: the
+ *  query span `[qs,qe)` standing where the candidate's `[cs,ce)` stands.
+ *
+ *  Two mechanisms read the same gap and ask OPPOSITE questions of it, which is
+ *  why the shape lives here rather than in either of them:
+ *
+ *    • the substitution bridge asks whether the two sides MEAN THE SAME, and
+ *      so EXPANDS the gap (absorbing flanking matched bytes) until the query
+ *      side is corpus-attested and the pair clears the concept bar;
+ *    • the frame reading asks WHERE THE SLOT IS, and so CONTRACTS it
+ *      ({@link contractGap}) until the two sides share nothing at all.
+ *
+ *  Neither reading is derivable from the other, and both need the same gap. */
+export interface AlignGap {
+  qs: number;
+  qe: number;
+  cs: number;
+  ce: number;
+}
+
+/** Extend a seed match (query offset qo ↔ candidate offset co) to its maximal
+ *  common run, then walk outward in both directions collecting further common
+ *  runs of at least W bytes across bounded mismatch gaps (each side ≤
+ *  chainReach).  Returns the matched query spans and the mismatch pairs
+ *  between consecutive runs.
+ *
+ *  This is the SEEDED aligner, distinct from {@link alignRuns}: that one finds
+ *  every run two structures share anywhere (a weave), this one reads two
+ *  streams as ONE structure that diverges in bounded places (a frame with
+ *  slots).
+ *
+ *  Gaps come back in SWEEP order (right sweep, then left), not query order,
+ *  and only the INTERIOR ones are reported — a consumer that needs the query's
+ *  unmatched head or tail derives it from `matched`.  Both are the bridge's
+ *  contract, which prices its edges separately (see its matchStart/matchEnd
+ *  window test); {@link frameSlots} takes the other reading. */
+export function alignAround(
+  ctx: MindContext,
+  q: Uint8Array,
+  c: Uint8Array,
+  qo: number,
+  co: number,
+): { matched: Array<[number, number]>; gaps: AlignGap[] } {
+  const W = ctx.space.maxGroup;
+  const reachCap = chainReach(W);
+  // Maximal run around the seed.
+  let qs = qo, ss = co;
+  while (qs > 0 && ss > 0 && q[qs - 1] === c[ss - 1]) {
+    qs--;
+    ss--;
+  }
+  let qe = qo, se = co;
+  while (qe < q.length && se < c.length && q[qe] === c[se]) {
+    qe++;
+    se++;
+  }
+  const matched: Array<[number, number]> = [[qs, qe]];
+  const gaps: AlignGap[] = [];
+  // The next common run of ≥ W bytes past (qi, si), with each side's gap
+  // bounded by chainReach; smallest total gap wins (nearest continuation).
+  const runLenAt = (qi: number, si: number): number => {
+    let n = 0;
+    while (qi + n < q.length && si + n < c.length && q[qi + n] === c[si + n]) {
+      n++;
+    }
+    return n;
+  };
+  // RIGHT sweep.
+  let qi = qe, si = se;
+  for (;;) {
+    let found = false;
+    for (let total = 1; total <= 2 * reachCap && !found; total++) {
+      for (let gq = 0; gq <= Math.min(total, reachCap); gq++) {
+        const gs = total - gq;
+        if (gs > reachCap) continue;
+        if (qi + gq >= q.length || si + gs >= c.length) continue;
+        const n = runLenAt(qi + gq, si + gs);
+        if (n >= W || qi + gq + n === q.length) {
+          if (n === 0) continue;
+          if (gq > 0 || gs > 0) {
+            gaps.push({ qs: qi, qe: qi + gq, cs: si, ce: si + gs });
+          }
+          matched.push([qi + gq, qi + gq + n]);
+          qi = qi + gq + n;
+          si = si + gs + n;
+          found = true;
+          break;
+        }
+      }
+    }
+    if (!found) break;
+  }
+  // LEFT sweep (mirror).
+  qi = qs;
+  si = ss;
+  for (;;) {
+    let found = false;
+    for (let total = 1; total <= 2 * reachCap && !found; total++) {
+      for (let gq = 0; gq <= Math.min(total, reachCap); gq++) {
+        const gs = total - gq;
+        if (gs > reachCap) continue;
+        if (qi - gq <= 0 || si - gs <= 0) continue;
+        // Run ENDING at (qi - gq, si - gs).
+        let n = 0;
+        while (
+          n < qi - gq && n < si - gs &&
+          q[qi - gq - 1 - n] === c[si - gs - 1 - n]
+        ) {
+          n++;
+        }
+        if (n >= W || n === qi - gq) {
+          if (n === 0) continue;
+          if (gq > 0 || gs > 0) {
+            gaps.push({ qs: qi - gq, qe: qi, cs: si - gs, ce: si });
+          }
+          matched.push([qi - gq - n, qi - gq]);
+          qi = qi - gq - n;
+          si = si - gs - n;
+          found = true;
+          break;
+        }
+      }
+    }
+    if (!found) break;
+  }
+  return { matched, gaps };
+}
+
+/** Contract a gap to its VARYING CORE: strip the prefix and suffix the two
+ *  sides share.  {@link alignAround} cannot match a shared affix shorter than
+ *  W, so that affix lands INSIDE the gap — measured, the slot of
+ *  `How do I compile main.c?` against `…hello.c?` comes back as
+ *  `main.c?`/`hello.c?`, three bytes of which (`.c?`) both sides hold.
+ *
+ *  Splicing the uncontracted gap carries the query's own punctuation into the
+ *  answer; worse, it hides what actually VARIES, which is the only thing a
+ *  cohort can agree about.  Returns null when nothing is left on either side —
+ *  a pure insertion or deletion, which names no slot. */
+export function contractGap(
+  q: Uint8Array,
+  c: Uint8Array,
+  g: AlignGap,
+): AlignGap | null {
+  let { qs, qe, cs, ce } = g;
+  while (qs < qe && cs < ce && q[qs] === c[cs]) {
+    qs++;
+    cs++;
+  }
+  while (qe > qs && ce > cs && q[qe - 1] === c[ce - 1]) {
+    qe--;
+    ce--;
+  }
+  return qe > qs && ce > cs ? { qs, qe, cs, ce } : null;
+}
+
+/** What one place two streams disagree IS, once contracted to its varying
+ *  core.  A consumer decides which kinds it can use; the matcher only reports.
+ *
+ *    substitution  both sides carry bytes — one thing stands where another does
+ *    insertion     the query carries bytes the candidate does not
+ *    deletion      the candidate carries bytes the query does not */
+export type SlotKind = "substitution" | "insertion" | "deletion";
+
+/** One VARIABLE POSITION of a pairing: where the query and a candidate differ,
+ *  contracted to the bytes that actually vary. */
+export interface FrameSlot {
+  /** Query span (empty for a deletion). */
+  qs: number;
+  qe: number;
+  /** Candidate span (empty for an insertion). */
+  cs: number;
+  ce: number;
+  kind: SlotKind;
+  /** The candidate's own bytes here — empty for an insertion. */
+  filler: Uint8Array;
+}
+
+/** One trained context read against the query as ONE structure with variable
+ *  positions.
+ *
+ *  EVERYTHING THE ALIGNER SAW, NOTHING JUDGED.  `slots` holds every place the
+ *  pairing varies, in query order, whatever its kind or size, and `covered`
+ *  says how much of the query the two hold in common.  No gate is applied
+ *  here — see {@link frameSlots}. */
+export interface FrameInstance {
+  /** The trained context this reading is against. */
+  id: number;
+  /** Every variable position, in query order. */
+  slots: FrameSlot[];
+  /** Query spans the pairing literally matched — the frame itself. */
+  matched: Array<[number, number]>;
+  /** Query bytes the frame accounts for: the size of what is shared. */
+  covered: number;
+}
+
+/** THE SLOT MATCHER: read one query ↔ context pairing as one structure with
+ *  variable positions.
+ *
+ *  IT REPORTS; IT DOES NOT JUDGE.  This returns every gap the aligner found,
+ *  contracted to its varying core and tagged with its kind, plus the shared
+ *  coverage — and rejects nothing.  That is the whole point of the split, and
+ *  it was got WRONG first: four VOICING gates (the frame must dominate the
+ *  query, each slot must reach one window on both sides, an insertion or
+ *  deletion disqualifies the pairing, fillers must be pairwise distinct) were
+ *  applied here, and every one of them is a requirement for SUBSTITUTING AND
+ *  SPEAKING, not for knowing where a pairing varies.  With them in place the
+ *  shared reading was reference-shaped: measured over four real pairings, three
+ *  were hidden from every consumer —
+ *
+ *    `What is the capital of the country where the Eiffel Tower is?`
+ *        against `What is the capital of France?`  (covered 23/61)  HIDDEN
+ *    `What is the capital of France, really?`      (an insertion)   HIDDEN
+ *    `What is the capital of Fran?`                (sub-window)     HIDDEN
+ *
+ *  — including the case of the one consumer that most obviously needed it.  A
+ *  shared layer with one usable consumer is private code at a public address.
+ *  Each gate now lives with the mechanism that needs it (see reference.ts).
+ *
+ *  Seeded at the origin, because a frame is shared structure the query and its
+ *  instances both OPEN with: the maximal run around (0,0) is the frame's head
+ *  and the sweeps find the rest.
+ *
+ *  Null only for a degenerate pairing (either side empty). */
+export function frameSlots(
+  ctx: MindContext,
+  query: Uint8Array,
+  cand: Uint8Array,
+  id: number,
+): FrameInstance | null {
+  if (query.length === 0 || cand.length === 0) return null;
+  const { matched, gaps } = alignAround(ctx, query, cand, 0, 0);
+  const spans = [...matched].sort((a, b) => a[0] - b[0]);
+  // Where the alignment RAN OUT on each side.  Seeded at the origin there is
+  // no leading gap, so both cursors are everything consumed so far: the
+  // matched runs (equal length on both sides by construction) plus what each
+  // interior gap ate of its own side.  Counting only the runs reads the
+  // candidate cursor short by exactly the fillers already seen, and invents a
+  // trailing gap on every well-aligned instance.
+  const all: AlignGap[] = [...gaps];
+  let qEnd = 0, cEnd = 0;
+  for (const [s, e] of spans) {
+    cEnd += e - s;
+    qEnd = Math.max(qEnd, e);
+  }
+  for (const g of gaps) cEnd += g.ce - g.cs;
+  if (qEnd < query.length || cEnd < cand.length) {
+    all.push({ qs: qEnd, qe: query.length, cs: cEnd, ce: cand.length });
+  }
+  const slots: FrameSlot[] = [];
+  for (const gap of all.sort((a, b) => a.qs - b.qs)) {
+    if (gap.qe <= gap.qs && gap.ce <= gap.cs) continue;
+    // Contract to the varying core.  contractGap returns null when one side is
+    // wholly shared with the other — a pure insertion or deletion, which is a
+    // real variation and is reported AS ONE, not discarded.
+    const core = contractGap(query, cand, gap);
+    const g = core ?? gap;
+    const kind: SlotKind = g.qe > g.qs && g.ce > g.cs
+      ? "substitution"
+      : g.qe > g.qs
+      ? "insertion"
+      : "deletion";
+    slots.push({
+      qs: g.qs,
+      qe: g.qe,
+      cs: g.cs,
+      ce: g.ce,
+      kind,
+      filler: cand.slice(g.cs, g.ce),
+    });
+  }
+  const covered = spans.reduce((n, [s, e]) => n + e - s, 0);
+  return { id, slots, matched: spans, covered };
+}
+
+/** THE DISPLACED-FILLER GATE: does `projection` speak the ANCHOR's occupant of
+ *  a position the query fills differently?
+ *
+ *  A mechanism grounding through an anchor voices that anchor's continuation.
+ *  When the query is the same structure as the anchor with one position filled
+ *  differently — a different filename, a different word — the anchor's
+ *  continuation is ABOUT THE ANCHOR'S occupant, and voicing it answers a
+ *  question the asker did not ask.  It is worse than silence, because it is
+ *  fluent and specific and wrong:
+ *
+ *      trained  `How do I compile hello.c?` -> `Run gcc hello.c`
+ *      asked    `How do I compile main.c?`
+ *      voiced   `Run gcc hello.c`            <- the corpus's file, not the asker's
+ *
+ *  The same shape on the trained 15.7M-node store: `How do you say 'flurbish'
+ *  in French?` answers "the way to say hello is \"Bonjour\"".
+ *
+ *  THIS IS NOT THE RESTATED-FRAGMENT GUARD.  That one asks whether the
+ *  projection is a piece of the QUERY; this asks whether it is a piece of the
+ *  ANCHOR that the query displaced.  Neither implies the other, and the
+ *  observed failures pass the restatement guard cleanly.
+ *
+ *  Three conditions, all byte-exact and all necessary:
+ *
+ *  1. the query and the anchor must be ONE STRUCTURE — what they share has to
+ *     dominate the query, or the query is not a variant of the anchor at all
+ *     and the anchor's occupant of anything is beside the point;
+ *  2. both sides of the position must reach one river window — below it byte
+ *     overlap is chance, not evidence (the floor identityBar and the bridge's
+ *     attestedQ both draw);
+ *  3. the projection must voice the anchor's filler and NOT the query's
+ *     referent.  Voicing both is a projection that carried the asker's own
+ *     occupant through, which is exactly what a licensed reference does and
+ *     must stay allowed;
+ *  4. and the projection must share NO perceivable content with the query
+ *     outside that position — no run of one river window.
+ *
+ *  GATE 4 IS WHAT SEPARATES A DIFFERENT THING FROM A DIFFERENT WORD, and
+ *  without it this refuses correct answers.  A displaced slot alone cannot
+ *  tell them apart: `symbol` <- `formula` and `main` <- `hello` are the same
+ *  shape to the matcher — one substitution slot, frame dominating.  Measured
+ *  on the trained store, gates 1-3 alone silenced
+ *
+ *      Q `What is the chemical symbol for water?`
+ *      A `The chemical formula for water is H2O.`
+ *
+ *  which is right, and merely phrased in the corpus's own words.  The answer
+ *  shares `the chemical ` and ` for water` with the question, so it is plainly
+ *  about what was asked.  `Run gcc hello.c` against `How do I compile main.c?`
+ *  shares nothing but `.c` — two bytes, below the window where overlap stops
+ *  being chance — so it is not about what was asked at all.  No new constant:
+ *  W is the same floor identityBar, attestedQ and the site test already draw. */
+export function voicesDisplacedFiller(
+  ctx: MindContext,
+  query: Uint8Array,
+  anchor: Uint8Array,
+  projection: Uint8Array,
+): boolean {
+  const W = ctx.space.maxGroup;
+  const inst = frameSlots(ctx, query, anchor, 0);
+  if (inst === null) return false;
+  if (!dominates(inst.covered, query.length)) return false;
+  for (const slot of inst.slots) {
+    if (slot.kind !== "substitution") continue;
+    if (slot.qe - slot.qs < W || slot.filler.length < W) continue;
+    if (indexOf(projection, slot.filler, 0) < 0) continue;
+    const referent = query.subarray(slot.qs, slot.qe);
+    if (indexOf(projection, referent, 0) >= 0) continue;
+    // Gate 4: does the projection still speak about the query's FRAME?  A run
+    // of one window anywhere outside the displaced position is enough — the
+    // answer is then about the thing that was asked, in the corpus's own
+    // wording.  Sharing nothing means it is about something else.
+    const shared = alignRuns(ctx, query, projection).some((r) =>
+      r.qe - r.qs >= W && (r.qe <= slot.qs || r.qs >= slot.qe)
+    );
+    if (shared) continue;
+    return true;
+  }
+  return false;
+}
+
+/** Whether every member is byte-distinct from the others. */
+export function distinct(items: readonly Uint8Array[]): boolean {
+  for (let i = 0; i < items.length; i++) {
+    for (let j = i + 1; j < items.length; j++) {
+      if (bytesEqual(items[i], items[j])) return false;
+    }
+  }
+  return true;
+}
+
+/** Substitute every `needle -> repl` pair SIMULTANEOUSLY: one left-to-right
+ *  pass, longest needle first at each position, and a replacement is never
+ *  re-examined.
+ *
+ *  SIMULTANEOUS IS NOT A DETAIL.  Applying the pairs in sequence lets one
+ *  substitution's OUTPUT be another's input: with slots `gcc -> zig` and
+ *  `hello.c -> zig.c` a sequential pass rewrites bytes it had just written,
+ *  and the result depends on the order the slots happened to be found in.
+ *  Longest-first at each position makes the pass independent of pair order,
+ *  which is what keeps {@link carriesFillers} and the binding it licenses the
+ *  SAME operation — if they could disagree, the licence would not be testing
+ *  what is voiced. */
+export function substituteAll(
+  hay: Uint8Array,
+  pairs: ReadonlyArray<{ needle: Uint8Array; repl: Uint8Array }>,
+): Uint8Array {
+  const usable = pairs.filter((p) => p.needle.length > 0);
+  if (usable.length === 0) return hay;
+  // Longest needle first, so a needle that is a prefix of another can never
+  // pre-empt it.  Ties cannot arise: an instance whose fillers are not
+  // pairwise distinct is refused by frameSlots.
+  const order = [...usable].sort((a, b) => b.needle.length - a.needle.length);
+  const out: number[] = [];
+  let i = 0;
+  let hit = false;
+  outer:
+  while (i < hay.length) {
+    for (const p of order) {
+      if (i + p.needle.length > hay.length) continue;
+      let k = 0;
+      while (k < p.needle.length && hay[i + k] === p.needle[k]) k++;
+      if (k < p.needle.length) continue;
+      for (const b of p.repl) out.push(b);
+      i += p.needle.length;
+      hit = true;
+      continue outer;
+    }
+    out.push(hay[i]);
+    i++;
+  }
+  return hit ? Uint8Array.from(out) : hay;
+}
+
+/** THE CARRIAGE LICENCE — the gate that decides whether a slot may be VOICED
+ *  through.  Given two instances of one frame and what each one continues to,
+ *  it asks one byte question:
+ *
+ *      substituteAll(contA, fillersA -> fillersB) == contB
+ *
+ *  When it holds, the corpus attests byte-exactly that the continuation is a
+ *  function of the fillers and nothing else, so putting a NEW occupant through
+ *  the same carriage is derivation rather than invention.  No threshold, no
+ *  similarity, no new constant: the store's own instances decide, exactly as
+ *  the bridge's `unanimous` decides whether a frame is a value slot.
+ *
+ *  Its FAILURE is what this is really for.  A frame whose continuation carries
+ *  filler-DEPENDENT content — `What is the capital of X?` answering a different
+ *  city per X — fails it, and that failure is the only thing between a slot
+ *  and an invented fact.  Measured on the trained 15.7M-node store (325,615
+ *  contexts): `What is the capital of Zamunda?` resonates to a PURE cohort,
+ *  every one of the top 14 hits an instance of that frame, with an unambiguous
+ *  slot; every structural gate passes and only this one refuses, on
+ *  `replace("Tokyo", "Japan" -> "France") != "Paris"`.
+ *
+ *  With SEVERAL slots the test is unchanged, which is the point of testing the
+ *  whole substitution at once: a frame whose answer tracks one slot but
+ *  invents around another fails exactly as a single-slot value slot does. */
+export function carriesFillers(
+  contA: Uint8Array,
+  fillersA: readonly Uint8Array[],
+  contB: Uint8Array,
+  fillersB: readonly Uint8Array[],
+): boolean {
+  if (fillersA.length !== fillersB.length) return false;
+  const projected = substituteAll(
+    contA,
+    fillersA.map((needle, s) => ({ needle, repl: fillersB[s] })),
+  );
+  return bytesEqual(projected, contB);
+}
+
 /** The IN-LIST halo matcher: the best halo-mate for `halo` among EXPLICIT
  *  candidates, above the concept threshold — the list counterpart of
  *  {@link haloSiblings}, which asks the halo INDEX for candidates instead.