@hviana/sema 0.6.0 → 0.7.1

package/.github/workflows/release.yml

@@ -0,0 +1,80 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: version to release, e.g. 0.6.1
+        type: string
+        required: true
+
+permissions:
+  # Trusted publishing (OIDC): GitHub mints a short-lived identity token that
+  # npm and JSR both exchange against the trusted publisher on the package.
+  # No registry token is stored anywhere.
+  id-token: write
+  # The release path bumps package.json + jsr.json, commits, and pushes the tag.
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: bump version and tag
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          current="$(node -p "require('./package.json').version")"
+          if [ "$current" != "$VERSION" ]; then
+            npm version "$VERSION" --no-git-tag-version
+            node -e 'const fs=require("fs");const p=JSON.parse(fs.readFileSync("jsr.json","utf8"));p.version=process.env.VERSION;fs.writeFileSync("jsr.json",JSON.stringify(p,null,2)+"\n")'
+            git add package.json jsr.json
+            git commit -m "$VERSION"
+            git tag -a "v$VERSION" -m "v$VERSION"
+            git push origin HEAD --follow-tags
+          fi
+
+      # The two manifests must not drift: a dual npm+JSR publish ships the SAME
+      # version to both, so a mismatch here would tag one and ship another.
+      - name: confirm package.json and jsr.json agree on version
+        run: |
+          pkg="$(node -p "require('./package.json').version")"
+          jsr="$(node -p "require('./jsr.json').version")"
+          if [ "$pkg" != "$jsr" ]; then
+            echo "package.json version $pkg != jsr.json version $jsr" >&2
+            exit 1
+          fi
+          echo "publishing version $pkg"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: https://registry.npmjs.org
+
+      - name: install
+        run: npm install
+
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; Node 24 bundles an older npm.
+      - name: update npm for trusted publishing
+        run: npm install -g npm@latest
+
+      # The same run publishes: a tag pushed with GITHUB_TOKEN does NOT
+      # re-trigger workflows, so the publish cannot depend on a second run.
+      # prepublishOnly (npm test) verifies and builds dist/ before packing.
+      # dist/ is gitignored (so it stays off GitHub and JSR) but ships to npm
+      # because .npmignore deliberately omits the `dist/` entry.
+      - name: publish to npm
+        run: npm publish --access public
+
+      # JSR publishes the SOURCE (jsr.json exports → src/index.ts), not dist/.
+      # dist/ is gitignored and JSR honours .gitignore, so it is excluded here
+      # with no --allow-dirty needed (the tree is clean after npm's build).
+      - name: publish to jsr
+        run: npx jsr publish

package/AGENTS.md

@@ -455,8 +455,7 @@ Asking never writes, which is the only reason per-response memos are sound.
 eager fields (recognition, computed spans, guide, the evidence-breadth constant
 `k`) plus **lazily-cached methods** for expensive analyses (`attention()` — the
 consensus climb, `weave()`, `resonance()` — the response's ONE top-k
-content-index read, `wideResonance()` — the one WIDE candidate list every
-past-the-top-k mechanism reads, `frames()` — the frame/slot inventory,
+content-index read, `frames()` — the frame/slot inventory,
 `spanShapedOf`/`spanShapedAll`, `queryWindows`, `queryResolved`, `windowsOf`,
 `reachMemo`) — each computed at most once, shared by mechanisms and
 post-grounding stages, and never computed if nobody asks. The async ones are
@@ -464,10 +463,13 @@ cached **by promise**, so a second caller awaits the first computation rather
 than starting another.
 
 Mind-level memos (`climbMemo`, `recogniseMemo`, `perceiveMemo`, `canonMemo`,
-`_resolvedSubtrees`, `_edgeChoice`, `_gistCache`) are created in
-`beginResponse()` and torn down in `endResponse()` — a new memo must be added to
-both. A conversation supplies its own maps for the first four, so they persist
-across turns.
+`_resolvedSubtrees`) are assigned in `beginResponse()` and nulled in
+`endResponse()` — a new per-response memo must be added to both. A conversation
+supplies its own maps for the first four, so they persist across turns.
+`_edgeChoice` is a Mind field CLEARED in `endResponse()` (not re-created).
+`_gistCache` is a SESSION-lifetime Mind field (32 MB, `mind.ts`) never touched
+by begin/endResponse: a node's bytes are immutable and perception is pure, so a
+cached gist is valid for the store's lifetime.
 
 **Which memos a trace bypasses, and why the answer is "almost none".** Only
 `_edgeChoice` (via `guidedNext`) and `sharedReachMemo` are trace-bypassed —
@@ -546,9 +548,9 @@ answer was chosen, the meter says what it cost. Four contracts:
    so two runs are diffable and a work regression is visible without a
    stopwatch. Only `elapsedMs` and the phase millisecond totals are not.
 3. **Phases nest, and carry their own counter deltas.** `think` ⊃ `<mech>.run` ⊃
-   `substitutionBridge` ⊃ `recall.exhaustiveResonate`. Inclusive, never summed —
-   but each phase reports the work done inside it (`PhaseCost.counters`), which
-   is what makes "which phase did those byte reads?" answerable at all.
+   `substitutionBridge`. Inclusive, never summed — but each phase reports the
+   work done inside it (`PhaseCost.counters`), which is what makes "which phase
+   did those byte reads?" answerable at all.
 4. **Count a logical operation once.** A recursive read (`bytesPrefix`
    descending a branch) is charged at the public entry point only — the private
    `_prefix` body is uncharged. Counting the recursion made one read of an
@@ -608,6 +610,48 @@ corruption via phrase-interior chunks) and the `couldGrow` liveness rule (O(N²)
 chart growth). When you fix a subtle bug, leave the constraint behind, not the
 story of the fix.
 
+### 2.17 Saturation — every walk decides, none drifts
+
+Saturation is a first-class control, not a secondary nicety — and it is TWO
+things, distinguished deliberately:
+
+- a CAP — a derived bound (√N per read, √N·W per walk) that exists only to stop
+  magic constants (§2.2) — is a SAFETY NET. It bounds the walk when its question
+  never decides (a side too common to ever settle). Derived, never tuned; but it
+  is not itself a decision.
+- a REAL saturation — a named, derived stop that DECIDES the walk's question and
+  terminates the moment it is decided. The cap remains as the backstop; the
+  saturation ends the walk. A walk with only a cap drifts to the cap every time;
+  a walk with a real saturation stops where the answer is already known.
+
+`edgeAncestors` is the model (EXPAND-UNTIL-DECIDED): a reach is consumed either
+as a VOTE (needs `contextsReached` exactly, only while ≤ √N) or as an ABSTENTION
+(`saturated`), so it stops at the FIRST of its five named stops and no consumer
+reads a saturated reach's roots or counts. `pivotInto`'s candidate scan is the
+second: "longest valid wins" is DECIDED at the first valid candidate in
+descending length, so it reads one winner's bytes, never every shorter
+candidate. Saturation is a DECISION about the answer — never a cache, never a
+budget.
+
+The junction walk's per-node hub guards are real per-node saturations; its
+`√N·W` budget is the NET, not a saturation. REFUTED (test/16 bridge synthesis,
+test/34 n-ary binding): a "stop once one side's cone is exhausted" early stop is
+WRONG, in both a hub-guarded and a hub-flagged form. The junction test is a BYTE
+containment over the UNION of the two cones, and a junction can be structurally
+reachable from only ONE side — the side whose seed is a FOLD sub-node of the
+container. test/16: "cold or hot" is reached from the window "cold", but the
+3-byte answer "hot" is not a 4-byte window of it, so "hot"'s cone empties after
+one pop while the junction still lies ahead in "cold"'s cone. "One cone
+exhausted" therefore never proves "no junction left", and the budget stays the
+net that backs the per-node saturations.
+
+_Follow it:_ when a new walk measures commonality against the corpus, name its
+saturation condition — the answer it may stop producing — beside its read cap.
+No code may traverse the inference uncontrolled from the corpus, nor lack the
+saturation its question admits. A cap without a saturation is a drift, and a
+drifting walk is a bug, not a tuning choice; do not mask it with a cache (§2.12)
+— a cache hides a drift on a warm store, saturation removes it.
+
 ---
 
 ## 3. Where things live

package/dist/src/meter.d.ts

@@ -4,7 +4,7 @@
  *  PHASES NEST, AND ARE NOT DISJOINT.  `think` contains every mechanism
  *  phase; a mechanism's `floor` contains whatever shared analysis it
  *  first-touched (`attention`, `weave`); `recall.run` contains
- *  `substitutionBridge`, which contains `recall.exhaustiveResonate`.  Read a
+ *  `substitutionBridge`.  Read a
  *  phase as "wall-clock spent inside this, inclusive" — never sum them and
  *  expect the total.  `CostReport.elapsedMs` is the only whole.
  *
@@ -148,9 +148,6 @@ export declare class Meter {
     mechanismRuns: number;
     /** Candidates the decider weighed. */
     candidates: number;
-    /** Candidates refused before the competition for explaining less than 1/W
-     *  of the query — the honesty-density floor (see pipeline.ts `consider`). */
-    thinRejects: number;
     private readonly _phases;
     private readonly _t0;
     /** Every work counter's current value, by name — the snapshot `time`

package/dist/src/meter.js

@@ -142,9 +142,6 @@ export class Meter {
     mechanismRuns = 0;
     /** Candidates the decider weighed. */
     candidates = 0;
-    /** Candidates refused before the competition for explaining less than 1/W
-     *  of the query — the honesty-density floor (see pipeline.ts `consider`). */
-    thinRejects = 0;
     // ── Phases ──────────────────────────────────────────────────────────────
     _phases = new Map();
     _t0 = performance.now();

package/dist/src/mind/attention.js

@@ -12,7 +12,7 @@ import { composeStructuralGist, consensusFloor, dominates, estimatorNoise, } fro
 import { foldTree, gistOf, latin1Key, perceive, read, resolve, } from "./primitives.js";
 import { recognise } from "./recognition.js";
 import { leafIdRun } from "./canonical.js";
-import { corpusN, edgeAncestors, hubBound, sharedReachMemo, } from "./traverse.js";
+import { atomIsHub, corpusN, edgeAncestors, hubBound, sharedReachMemo, } from "./traverse.js";
 import { cachedRead, junctionContainersFrom, junctionSeeds, junctionSynonyms, loadJunctionSynonymSides, walkCache, } from "./junction.js";
 import { indexOf } from "../bytes.js";
 import { rItem, rNode, traceDerivation } from "./trace.js";
@@ -1848,26 +1848,28 @@ async function crossRegionVotes(ctx, query, regions, rvs, k, N, reachMemo, td) {
     // the same container (or a sub-container of it) twice.
     const consumed = new Set();
     let probes = 0;
-    // Once atoms themselves are hubs (N > W²), the cross-region analysis gets
-    // one k·W walk allowance per evidence tier. Without a shared allowance,
-    // each of k candidate pairs spends the full corpus-derived budget and a
-    // cumulative dialogue multiplies bounded work into tens of seconds. Small
-    // corpora retain exhaustive exact traversal: below this same scale the
-    // budget would be smaller than the structures the tests deliberately build.
+    // When atoms themselves are hubs (atomIsHub — a single byte reaches ≥ √N
+    // contexts, §2.8's own predicate), the corpus is large enough that the
+    // cross-region junction walks are dominated by the drift through common
+    // content's ancestry.  Each of k candidate pairs otherwise spends its own
+    // √N·W budget (profiled: 160,210 junction pops, 31% of think at
+    // N = 325,608), and a cumulative dialogue multiplies bounded work into tens
+    // of seconds.  The structural walk is therefore given ONE k·W allowance per
+    // evidence tier, shared across every pair — k pairs × W phrase-scale levels,
+    // the minimal exact check; a pair whose container is not reached within it
+    // falls through to the resonance tier (the ANN proposes what the shallow
+    // walk no longer exhaustively scans, §2.3).
     //
-    // MEASURED 2026-07-29, NOT YET RESOLVED.  This gate never engages at real
-    // scale: on the trained store N = 325,608 with k = 24 and W = 4, so the
-    // threshold is 96³ = 884,736 and a third of a million contexts still runs
-    // unbudgeted at hubBound·W = 2,280 pops PER PAIR — 160,210 junction pops,
-    // 5.9s, 31% of think.  Sharing one hubBound·W allowance across all pairs
-    // instead cuts that to 22,418 pops and 2.6s (think −19%), but is measurably
-    // too tight below ~10³ contexts: test/36 (N = 8, budget 8) loses the
-    // `red circle` binding root and test/14 (N = 120, budget 40) recalls 39/40.
-    // The sharing is the right shape; hubBound·W is the wrong size for it, and
-    // fitting a size to those two points would repeat the mistake the cube
-    // already makes — pricing the gate on the synthetic corpora.
-    const marketScale = k * ctx.space.maxGroup;
-    const corpusScale = N > marketScale ** 3;
+    // Below atomIsHub the store is small and atoms still discriminate, so the
+    // walks keep exhaustive exact traversal (per-walk √N·W) — the shared budget
+    // would otherwise be smaller than the structures the tests deliberately
+    // build.  The gate is the SAME derived predicate the climb already uses for
+    // byte atoms, not a separate corpus-size knob: an earlier `N > (k·W)³` cube
+    // never engaged at real scale (96³ = 884,736 > 325,608), and a "share one
+    // √N·W" experiment was too tight below ~10³ contexts (test/36, test/14) —
+    // both are the same mistake of pricing the gate on corpus size instead of on
+    // the atom-hub scale.
+    const corpusScale = atomIsHub(ctx, N);
     const exactBudget = corpusScale ? { n: k * ctx.space.maxGroup } : undefined;
     const synonymBudget = corpusScale ? { n: k * ctx.space.maxGroup } : undefined;
     for (let a = 0; a < cand.length && probes < k; a++) {

package/dist/src/mind/graph-search.d.ts

@@ -66,6 +66,13 @@ export type GItem = {
      *  because subtraction is more "the point" of its query).  See
      *  {@link liftAnswer}. */
     computed?: boolean;
+    /** Set on the out emitted at a chain's GENUINE FIXPOINT — the one span kind a
+     *  recursive re-cover ({@link GraphSearch.recompleteNode}) may deepen.  The
+     *  re-cover does NOT run here: this marks the span as eligible, and
+     *  {@link GraphSearch.deepen} runs it afterwards on the spans the lightest
+     *  derivation actually CHOSE.  Part of {@link key}, because it decides
+     *  whether the span's final bytes may still change. */
+    fix?: boolean;
 };
 export declare const STEP = 1;
 export declare const CONCEPT = 10;
@@ -87,6 +94,10 @@ export interface Seg {
     /** See the `computed` field of the "out" {@link GItem} — set only for an
      *  extension's derived value, never a genuinely recognised learned form. */
     computed?: boolean;
+    /** See the `fix` field of the "out" {@link GItem} — this span ended a chain at
+     *  a genuine fixpoint, so it is the one span kind a recursive re-cover may
+     *  still deepen.  Consumed by {@link GraphSearch.deepen}. */
+    fix?: boolean;
 }
 /** One rule application inside the cover's lightest derivation — the FINEST
  *  grain of Sema's core reasoning, one node of the adapted A*LD proof tree.  `move`
@@ -192,6 +203,20 @@ export declare class GraphSearch {
      *  decomposes, two recomposes, any mix — and stops only when it reaches a node
      *  that leads nowhere new, never at an arbitrary count. */
     private solve;
+    /** Re-cover the CHOSEN fixpoint spans, in place.
+     *
+     *  Completion is still "cover, recursively" — it just runs on the answer
+     *  instead of on the exploration.  A cover chooses O(segs) spans, so a level
+     *  pays O(answer) re-covers however densely the corpus interconnects the forms
+     *  the search passed through on the way.  That is the bound
+     *  {@link recompleteNode}'s contract always claimed and, running per fixpoint
+     *  REACHED, never had.
+     *
+     *  Deepening cannot change which cover won: the derivation is already final
+     *  and every span keeps its i..j and its cost.  It only replaces a chosen
+     *  span's bytes with the deeper learnt form they rewrite to — what the
+     *  recursion was always for. */
+    private deepen;
     /** The weighted deduction system the graph exploration solves (the four
      *  reductions of adapted A*LD live in {@link lightestDerivation}; this only states the
      *  items, axioms, goal, and rules — see {@link GItem} for the item kinds).
@@ -253,20 +278,29 @@ export declare class GraphSearch {
      *  ({@link resolve}) — the graph itself gates against re-expanding a contained
      *  form ("ice is cold" ⊅→ "ice is cold is cold").
      *
-     *  Termination is INTRINSIC, not a depth limit: a node already on the
-     *  completion stack ({@link recompleteOpen}) is not re-entered — a self-
-     *  referential recomposition is a cycle that can yield nothing new, so it
-     *  stops there, exactly as {@link completeForward} stops on a revisited edge.
-     *  Distinct node ids are finite and each finished completion is memoised, so a
-     *  legitimate chain runs as deep as the graph licenses and no further. */
+     *  Termination is STRUCTURAL: a produced node is re-covered once, never inside
+     *  another re-cover (see the guard below), so one cover pays at most one
+     *  nested {@link solve} per distinct produced node it actually reaches, and
+     *  {@link recompleteMemo} collapses a repeat to nothing.
+     *
+     *  This comment used to argue termination from "distinct node ids are finite
+     *  and each finished completion is memoised".  That is a bound of N — the one
+     *  AGENTS §2.8 forbids — and it was load-bearing, not pedantic: nested, the
+     *  recursion reached depth 331 and 9.1 GB on an 18.9M-node store for a 2-byte
+     *  query and did not terminate, which is what killed a 5 h training run at its
+     *  checkpoint recall.  Guard: test/89-completion-recursion.test.mjs. */
     private recompleteNode;
     /** Per-cover memo of each produced node's completion (so the many terminal
      *  outs of a long query re-cover each distinct node at most once); reset at the
      *  top of {@link cover}. */
     private recompleteMemo;
-    /** The nodes currently being re-completed — the recursion stack.  A node in
-     *  this set is not re-entered, so a cyclic recomposition terminates naturally
-     *  (the same cycle guard {@link completeForward} uses), with no depth cap. */
+    /** The node currently being re-completed — the recursion stack, and so also
+     *  the nesting depth.  {@link recompleteNode} refuses to start while it is
+     *  non-empty (one re-cover per produced node, never one inside another), which
+     *  is what keeps a query's cost proportional to its answer rather than to the
+     *  corpus; it therefore holds at most one id.  A Set, not a flag, because it
+     *  states WHICH node is open — the invariant a reader needs to check the
+     *  guard, and what makes the old cycle-guard reading still hold. */
     private recompleteOpen;
     /** out(i,j,bytes,…): index it for the binary rules, then offer splicing a
      *  learnt connector (the in-search bridge), splitting (at a sub-leaf form

package/dist/src/mind/graph-search.js

@@ -64,6 +64,7 @@ function readCover(derivation) {
                 rec: out.rec,
                 node: out.node,
                 computed: out.computed,
+                fix: out.fix,
             });
         }
         node = node.premises[0];
@@ -269,9 +270,32 @@ export class GraphSearch {
             onDerivation(readDerivation(derivation, substitutions !== undefined));
         }
         return derivation
-            ? { segs: readCover(derivation), cost: derivation.cost }
+            ? { segs: this.deepen(readCover(derivation)), cost: derivation.cost }
             : null;
     }
+    /** Re-cover the CHOSEN fixpoint spans, in place.
+     *
+     *  Completion is still "cover, recursively" — it just runs on the answer
+     *  instead of on the exploration.  A cover chooses O(segs) spans, so a level
+     *  pays O(answer) re-covers however densely the corpus interconnects the forms
+     *  the search passed through on the way.  That is the bound
+     *  {@link recompleteNode}'s contract always claimed and, running per fixpoint
+     *  REACHED, never had.
+     *
+     *  Deepening cannot change which cover won: the derivation is already final
+     *  and every span keeps its i..j and its cost.  It only replaces a chosen
+     *  span's bytes with the deeper learnt form they rewrite to — what the
+     *  recursion was always for. */
+    deepen(segs) {
+        for (const s of segs) {
+            if (!s.fix || s.node === undefined)
+                continue;
+            const deeper = this.recompleteNode(s.node);
+            if (deeper !== null)
+                s.bytes = deeper;
+        }
+        return segs;
+    }
     /** The weighted deduction system the graph exploration solves (the four
      *  reductions of adapted A*LD live in {@link lightestDerivation}; this only states the
      *  items, axioms, goal, and rules — see {@link GItem} for the item kinds).
@@ -319,7 +343,7 @@ export class GraphSearch {
                 if (it.kind === "form") {
                     return `f${it.i}.${it.j}.${it.node}.${it.via ? 1 : 0}.${it.rcmp ? 1 : 0}`;
                 }
-                return `o${it.i}.${it.j}.${it.cover ? 1 : 0}.${it.rec ? 1 : 0}.${it.node ?? -1}.${latin1(it.bytes)}`;
+                return `o${it.i}.${it.j}.${it.cover ? 1 : 0}.${it.rec ? 1 : 0}.${it.fix ? 1 : 0}.${it.node ?? -1}.${latin1(it.bytes)}`;
             },
             *axioms() {
                 yield { item: { kind: "cover", p: 0 }, cost: 0 };
@@ -614,17 +638,29 @@ export class GraphSearch {
             // actual end, never per intermediate stop — so its cost tracks the
             // ANSWER's own structure, not how densely the corpus interconnects
             // the nodes passed through on the way there.
-            const deeper = this.recompleteNode(it.node);
+            // MARK the fixpoint; do not re-cover it here.  Re-covering at this point
+            // pays a full {@link recompleteNode} — a recognition of the node's whole
+            // bytes — for every fixpoint the exploration REACHES, and how many it
+            // reaches is set by how densely the corpus interconnects the forms passed
+            // through.  Measured on an 18.9M-node store, a 2-byte query: 12,000
+            // re-covers inside ONE cover, folding 95,258 distinct spans, ~2.4 GB and
+            // climbing to a V8 fatal.  The answer needs a handful.
+            //
+            // {@link deepen} runs it instead on the spans the lightest derivation
+            // CHOSE.  The ladder is untouched — this out still costs 0, so a genuine
+            // fixpoint still beats any premature stop at the same depth, exactly as
+            // the ordering above states.
             yield {
                 premises: [it],
                 conclusion: {
                     kind: "out",
                     i: it.i,
                     j: it.j,
-                    bytes: deeper ?? nodeBytes(it.node),
+                    bytes: nodeBytes(it.node),
                     cover: true,
                     rec: true,
                     node: it.node,
+                    fix: true,
                 },
                 cost: 0,
             };
@@ -694,20 +730,47 @@ export class GraphSearch {
      *  ({@link resolve}) — the graph itself gates against re-expanding a contained
      *  form ("ice is cold" ⊅→ "ice is cold is cold").
      *
-     *  Termination is INTRINSIC, not a depth limit: a node already on the
-     *  completion stack ({@link recompleteOpen}) is not re-entered — a self-
-     *  referential recomposition is a cycle that can yield nothing new, so it
-     *  stops there, exactly as {@link completeForward} stops on a revisited edge.
-     *  Distinct node ids are finite and each finished completion is memoised, so a
-     *  legitimate chain runs as deep as the graph licenses and no further. */
+     *  Termination is STRUCTURAL: a produced node is re-covered once, never inside
+     *  another re-cover (see the guard below), so one cover pays at most one
+     *  nested {@link solve} per distinct produced node it actually reaches, and
+     *  {@link recompleteMemo} collapses a repeat to nothing.
+     *
+     *  This comment used to argue termination from "distinct node ids are finite
+     *  and each finished completion is memoised".  That is a bound of N — the one
+     *  AGENTS §2.8 forbids — and it was load-bearing, not pedantic: nested, the
+     *  recursion reached depth 331 and 9.1 GB on an 18.9M-node store for a 2-byte
+     *  query and did not terminate, which is what killed a 5 h training run at its
+     *  checkpoint recall.  Guard: test/89-completion-recursion.test.mjs. */
     recompleteNode(node) {
         if (!this.host.recogniseSpan)
             return null;
         const memo = this.recompleteMemo;
         if (memo.has(node))
             return memo.get(node) ?? null;
-        // Cycle guard: a node being completed must not recurse back into itself.
-        if (this.recompleteOpen.has(node))
+        // ONE re-cover per produced node — never a re-cover inside a re-cover.
+        //
+        // Re-covering is how a PRODUCED node's bytes enter the search at all: the
+        // cover machinery otherwise only ever sees the QUERY's spans.  That is
+        // needed once.  The alternation of decomposition and recomposition that
+        // follows — parts rewriting several times, siblings fusing, a recomposition
+        // feeding another — is the main search's own fuse/`rcmp` work, not this
+        // recursion's: 15-decomposition-gap §9–§12 all pass with this method
+        // disabled outright, and only §6 (the produced composite "p1 p2", whose
+        // bytes nothing else brings in) needs it.
+        //
+        // Nesting it was the defect.  Each level is a full {@link solve} with its
+        // own agenda and chart, exploring from a node the answer never asked about,
+        // so per-query cost tracked how densely the corpus interconnects the forms
+        // passed through — the growth AGENTS §2.8 forbids.  Measured on an
+        // 18.9M-node store: depth 331 and 9.1 GB for a 2-byte query, not
+        // terminating; and on the guard corpus every one of 125 nested re-covers
+        // was REJECTED by the resolve() gate below, expanding a 70-byte node into a
+        // 374-byte concatenation that names nothing.  All of it was waste.
+        //
+        // `recompleteOpen` is that stack, so a non-empty stack means we are already
+        // inside one.  This subsumes the old cycle guard: a node cannot recurse
+        // back into itself when nothing recurses at all.
+        if (this.recompleteOpen.size > 0)
             return null;
         // A leaf or single-child node has no parts to recompose; skip before the
         // costly recognition so a plain terminal answer pays nothing.
@@ -740,9 +803,13 @@ export class GraphSearch {
      *  outs of a long query re-cover each distinct node at most once); reset at the
      *  top of {@link cover}. */
     recompleteMemo = new Map();
-    /** The nodes currently being re-completed — the recursion stack.  A node in
-     *  this set is not re-entered, so a cyclic recomposition terminates naturally
-     *  (the same cycle guard {@link completeForward} uses), with no depth cap. */
+    /** The node currently being re-completed — the recursion stack, and so also
+     *  the nesting depth.  {@link recompleteNode} refuses to start while it is
+     *  non-empty (one re-cover per produced node, never one inside another), which
+     *  is what keeps a query's cost proportional to its answer rather than to the
+     *  corpus; it therefore holds at most one id.  A Set, not a flag, because it
+     *  states WHICH node is open — the invariant a reader needs to check the
+     *  guard, and what makes the old cycle-guard reading still hold. */
     recompleteOpen = new Set();
     /** out(i,j,bytes,…): index it for the binary rules, then offer splicing a
      *  learnt connector (the in-search bridge), splitting (at a sub-leaf form

package/dist/src/mind/junction.d.ts

@@ -96,6 +96,19 @@ export declare function cachedRead(ctx: MindContext, cache: WalkCache | null, id
  *     edgeAncestors' question and wrong for this one: a junction container
  *     is legitimately reached across many containing structures.  Half the
  *     successful junctions would be lost.
+ *
+ *     REFUTED EARLY-STOP (side-cone exhaustion, §2.17's "real saturation"):
+ *     stopping the walk the moment ONE side's upward cone is emptied is wrong,
+ *     in both a hub-guarded form and a hub-flagged form.  The junction test is
+ *     a BYTE containment over the UNION of the two cones, and a junction can be
+ *     structurally reachable from only ONE side — the side whose seed is a
+ *     FOLD sub-node of the container (test/16: "cold or hot" is reached from
+ *     the window "cold", but the 3-byte answer "hot" is not a 4-byte window of
+ *     it, so "hot"'s cone is empty while the junction still lies ahead in
+ *     "cold"'s cone; test/34's n-ary binding fails the hub-guarded form the
+ *     same way).  "One cone exhausted" therefore never proves "no junction
+ *     left", and the walk must keep the √N·W budget as its NET after the
+ *     per-node saturations below.
  *   • per-node hub guards — parent fan-outs beyond √N are hubs (not
  *     expanded); each node contributes at most one √N page of containers;
  *     √N collected candidates decide. */

package/dist/src/mind/junction.js

@@ -134,6 +134,19 @@ function cachedContainers(ctx, cache, id, limit) {
  *     edgeAncestors' question and wrong for this one: a junction container
  *     is legitimately reached across many containing structures.  Half the
  *     successful junctions would be lost.
+ *
+ *     REFUTED EARLY-STOP (side-cone exhaustion, §2.17's "real saturation"):
+ *     stopping the walk the moment ONE side's upward cone is emptied is wrong,
+ *     in both a hub-guarded form and a hub-flagged form.  The junction test is
+ *     a BYTE containment over the UNION of the two cones, and a junction can be
+ *     structurally reachable from only ONE side — the side whose seed is a
+ *     FOLD sub-node of the container (test/16: "cold or hot" is reached from
+ *     the window "cold", but the 3-byte answer "hot" is not a 4-byte window of
+ *     it, so "hot"'s cone is empty while the junction still lies ahead in
+ *     "cold"'s cone; test/34's n-ary binding fails the hub-guarded form the
+ *     same way).  "One cone exhausted" therefore never proves "no junction
+ *     left", and the walk must keep the √N·W budget as its NET after the
+ *     per-node saturations below.
  *   • per-node hub guards — parent fan-outs beyond √N are hubs (not
  *     expanded); each node contributes at most one √N page of containers;
  *     √N collected candidates decide. */

package/dist/src/mind/mechanisms/cover.js

@@ -42,7 +42,9 @@ export async function resolveConnectors(ctx, sites, query) {
     // transcript evidence: cover still needs the site for structural context,
     // but liftAnswer will trim that continuation as already answered. Building
     // pairwise/n-ary bridges for it can only create connectors that are later
-    // discarded, and on cumulative dialogue that dominated the whole search.
+    // discarded — a semantically neutral gate (it removes work whose product
+    // liftAnswer throws away), and a cumulative (multi-turn) query is exactly
+    // where such already-answered continuations recur.
     let answered = 0;
     const ordered = [...sites]
         .sort((a, b) => a.start - b.start)
@@ -56,7 +58,26 @@ export async function resolveConnectors(ctx, sites, query) {
         if (query === undefined || ctx.answeredSpans.length === 0)
             return true;
         const continuations = ctx.store.nextFirst(s.payload, hubBound(ctx));
-        return !continuations.some((answer) => indexOf(query, read(ctx, answer), 0) >= 0);
+        return !continuations.some((answer) => {
+            // PREFIX-CAPPED (AGENTS §2.8): a candidate longer than the query cannot
+            // occur INSIDE it, so read one byte past the query's length — enough to
+            // detect the overflow — and reject without reconstructing the rest.
+            // The `+ 1` is what makes the test exact rather than a truncation: a
+            // result of exactly `query.length + 1` bytes is known to be too long,
+            // and anything shorter is the candidate's COMPLETE content, so the
+            // substring test below is the same test as before.  (The same overflow
+            // probe bridge.ts:256 already uses.)
+            //
+            // This loop runs up to hubBound(ctx) = √N reads PER SITE, and only on a
+            // multi-turn response — `answeredSpans` is empty for a plain respond(),
+            // so the probe does not execute there.  The cap cannot reduce the read
+            // COUNT — only a semantic change to the "already answered" test could —
+            // but it bounds each read by the query instead of by the corpus, which
+            // is what §2.8 asks for and what rescues a SHORT query: at 3 bytes this
+            // reads 4 bytes per candidate instead of the ~231 it averaged before.
+            const bytes = read(ctx, answer, query.length + 1);
+            return bytes.length <= query.length && indexOf(query, bytes, 0) >= 0;
+        });
     });
     const bridgePair = async (l, r) => {
         if (l === r || links.has(l + "," + r))

package/dist/src/mind/mechanisms/prefix-completion.js

@@ -204,9 +204,9 @@ export const prefixMechanism = {
     provenance: "prefix",
     async floor(ctx, query, _pre, worthRunning) {
         // One projection: the form is voiced whole, nothing is substituted.
-        // INVESTMENT DISCIPLINE — the supplies below are the response's wide
-        // candidate list and a bounded √N walk, so neither is touched until the
-        // bound can still beat the incumbent.
+        // INVESTMENT DISCIPLINE — the supplies below are a bounded √N window walk
+        // and the response's memoised top-k resonance read, so neither is touched
+        // until the bound can still beat the incumbent.
         if (!worthRunning(STEP))
             return STEP;
         // A query with no room for a perceivable continuation inside the phrase
@@ -218,14 +218,16 @@ export const prefixMechanism = {
         return STEP;
     },
     async run(ctx, query, pre) {
-        // The response's shared wide list first; only when it supplies nothing does
-        // the write side's window index propose.  That ordering is the whole cost
-        // story: a query the ranked list can already explain pays not one extra
-        // read, and the bounded walk is spent only where the alternative is an
-        // empty answer.  A second SUPPLY, not a second mechanism — the same three
-        // guards decide either way.
-        const completed = prefixCompletion(ctx, query, await pre.wideResonance()) ??
-            prefixCompletion(ctx, query, formsOpenedBy(ctx, query));
+        // The write side's window index proposes FIRST: a proper prefix's gist
+        // cannot rank its own continuation (cos falls below reachThreshold at a
+        // few bytes of truncation), so the content-addressed window walk is the
+        // correct measure for this question (§2.3), and it is a bounded √N walk —
+        // cheaper than an exhaustive ANN.  The top-k resonance list is the SECOND
+        // supply, for prefixes long enough that the gist still ranks the form.  A
+        // second SUPPLY, not a second mechanism — the same three guards decide
+        // either way.
+        const completed = prefixCompletion(ctx, query, formsOpenedBy(ctx, query)) ??
+            prefixCompletion(ctx, query, (await pre.resonance()).map((h) => h.id));
         if (completed === null)
             return [];
         return [{