@hviana/sema 0.6.0 → 0.7.2

package/.github/workflows/release.yml

@@ -0,0 +1,80 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: version to release, e.g. 0.6.1
+        type: string
+        required: true
+
+permissions:
+  # Trusted publishing (OIDC): GitHub mints a short-lived identity token that
+  # npm and JSR both exchange against the trusted publisher on the package.
+  # No registry token is stored anywhere.
+  id-token: write
+  # The release path bumps package.json + jsr.json, commits, and pushes the tag.
+  contents: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: bump version and tag
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          current="$(node -p "require('./package.json').version")"
+          if [ "$current" != "$VERSION" ]; then
+            npm version "$VERSION" --no-git-tag-version
+            node -e 'const fs=require("fs");const p=JSON.parse(fs.readFileSync("jsr.json","utf8"));p.version=process.env.VERSION;fs.writeFileSync("jsr.json",JSON.stringify(p,null,2)+"\n")'
+            git add package.json jsr.json
+            git commit -m "$VERSION"
+            git tag -a "v$VERSION" -m "v$VERSION"
+            git push origin HEAD --follow-tags
+          fi
+
+      # The two manifests must not drift: a dual npm+JSR publish ships the SAME
+      # version to both, so a mismatch here would tag one and ship another.
+      - name: confirm package.json and jsr.json agree on version
+        run: |
+          pkg="$(node -p "require('./package.json').version")"
+          jsr="$(node -p "require('./jsr.json').version")"
+          if [ "$pkg" != "$jsr" ]; then
+            echo "package.json version $pkg != jsr.json version $jsr" >&2
+            exit 1
+          fi
+          echo "publishing version $pkg"
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: https://registry.npmjs.org
+
+      - name: install
+        run: npm install
+
+      # Trusted publishing (OIDC) needs npm >= 11.5.1; Node 24 bundles an older npm.
+      - name: update npm for trusted publishing
+        run: npm install -g npm@latest
+
+      # The same run publishes: a tag pushed with GITHUB_TOKEN does NOT
+      # re-trigger workflows, so the publish cannot depend on a second run.
+      # prepublishOnly (npm test) verifies and builds dist/ before packing.
+      # dist/ is gitignored (so it stays off GitHub and JSR) but ships to npm
+      # because .npmignore deliberately omits the `dist/` entry.
+      - name: publish to npm
+        run: npm publish --access public
+
+      # JSR publishes the SOURCE (jsr.json exports → src/index.ts), not dist/.
+      # dist/ is gitignored and JSR honours .gitignore, so it is excluded here
+      # with no --allow-dirty needed (the tree is clean after npm's build).
+      - name: publish to jsr
+        run: npx jsr publish

package/AGENTS.md

@@ -455,8 +455,7 @@ Asking never writes, which is the only reason per-response memos are sound.
 eager fields (recognition, computed spans, guide, the evidence-breadth constant
 `k`) plus **lazily-cached methods** for expensive analyses (`attention()` — the
 consensus climb, `weave()`, `resonance()` — the response's ONE top-k
-content-index read, `wideResonance()` — the one WIDE candidate list every
-past-the-top-k mechanism reads, `frames()` — the frame/slot inventory,
+content-index read, `frames()` — the frame/slot inventory,
 `spanShapedOf`/`spanShapedAll`, `queryWindows`, `queryResolved`, `windowsOf`,
 `reachMemo`) — each computed at most once, shared by mechanisms and
 post-grounding stages, and never computed if nobody asks. The async ones are
@@ -464,10 +463,13 @@ cached **by promise**, so a second caller awaits the first computation rather
 than starting another.
 
 Mind-level memos (`climbMemo`, `recogniseMemo`, `perceiveMemo`, `canonMemo`,
-`_resolvedSubtrees`, `_edgeChoice`, `_gistCache`) are created in
-`beginResponse()` and torn down in `endResponse()` — a new memo must be added to
-both. A conversation supplies its own maps for the first four, so they persist
-across turns.
+`_resolvedSubtrees`) are assigned in `beginResponse()` and nulled in
+`endResponse()` — a new per-response memo must be added to both. A conversation
+supplies its own maps for the first four, so they persist across turns.
+`_edgeChoice` is a Mind field CLEARED in `endResponse()` (not re-created).
+`_gistCache` is a SESSION-lifetime Mind field (32 MB, `mind.ts`) never touched
+by begin/endResponse: a node's bytes are immutable and perception is pure, so a
+cached gist is valid for the store's lifetime.
 
 **Which memos a trace bypasses, and why the answer is "almost none".** Only
 `_edgeChoice` (via `guidedNext`) and `sharedReachMemo` are trace-bypassed —
@@ -546,9 +548,9 @@ answer was chosen, the meter says what it cost. Four contracts:
    so two runs are diffable and a work regression is visible without a
    stopwatch. Only `elapsedMs` and the phase millisecond totals are not.
 3. **Phases nest, and carry their own counter deltas.** `think` ⊃ `<mech>.run` ⊃
-   `substitutionBridge` ⊃ `recall.exhaustiveResonate`. Inclusive, never summed —
-   but each phase reports the work done inside it (`PhaseCost.counters`), which
-   is what makes "which phase did those byte reads?" answerable at all.
+   `substitutionBridge`. Inclusive, never summed — but each phase reports the
+   work done inside it (`PhaseCost.counters`), which is what makes "which phase
+   did those byte reads?" answerable at all.
 4. **Count a logical operation once.** A recursive read (`bytesPrefix`
    descending a branch) is charged at the public entry point only — the private
    `_prefix` body is uncharged. Counting the recursion made one read of an
@@ -608,6 +610,48 @@ corruption via phrase-interior chunks) and the `couldGrow` liveness rule (O(N²)
 chart growth). When you fix a subtle bug, leave the constraint behind, not the
 story of the fix.
 
+### 2.17 Saturation — every walk decides, none drifts
+
+Saturation is a first-class control, not a secondary nicety — and it is TWO
+things, distinguished deliberately:
+
+- a CAP — a derived bound (√N per read, √N·W per walk) that exists only to stop
+  magic constants (§2.2) — is a SAFETY NET. It bounds the walk when its question
+  never decides (a side too common to ever settle). Derived, never tuned; but it
+  is not itself a decision.
+- a REAL saturation — a named, derived stop that DECIDES the walk's question and
+  terminates the moment it is decided. The cap remains as the backstop; the
+  saturation ends the walk. A walk with only a cap drifts to the cap every time;
+  a walk with a real saturation stops where the answer is already known.
+
+`edgeAncestors` is the model (EXPAND-UNTIL-DECIDED): a reach is consumed either
+as a VOTE (needs `contextsReached` exactly, only while ≤ √N) or as an ABSTENTION
+(`saturated`), so it stops at the FIRST of its five named stops and no consumer
+reads a saturated reach's roots or counts. `pivotInto`'s candidate scan is the
+second: "longest valid wins" is DECIDED at the first valid candidate in
+descending length, so it reads one winner's bytes, never every shorter
+candidate. Saturation is a DECISION about the answer — never a cache, never a
+budget.
+
+The junction walk's per-node hub guards are real per-node saturations; its
+`√N·W` budget is the NET, not a saturation. REFUTED (test/16 bridge synthesis,
+test/34 n-ary binding): a "stop once one side's cone is exhausted" early stop is
+WRONG, in both a hub-guarded and a hub-flagged form. The junction test is a BYTE
+containment over the UNION of the two cones, and a junction can be structurally
+reachable from only ONE side — the side whose seed is a FOLD sub-node of the
+container. test/16: "cold or hot" is reached from the window "cold", but the
+3-byte answer "hot" is not a 4-byte window of it, so "hot"'s cone empties after
+one pop while the junction still lies ahead in "cold"'s cone. "One cone
+exhausted" therefore never proves "no junction left", and the budget stays the
+net that backs the per-node saturations.
+
+_Follow it:_ when a new walk measures commonality against the corpus, name its
+saturation condition — the answer it may stop producing — beside its read cap.
+No code may traverse the inference uncontrolled from the corpus, nor lack the
+saturation its question admits. A cap without a saturation is a drift, and a
+drifting walk is a bug, not a tuning choice; do not mask it with a cache (§2.12)
+— a cache hides a drift on a warm store, saturation removes it.
+
 ---
 
 ## 3. Where things live

package/HOW_IT_WORKS.md

@@ -4434,16 +4434,19 @@ before the conversion. Derived from the existing bars; never tuned.
 ### 21.5 The refusal path — the substitution bridge, before silence
 
 Everything geometric has now failed. One tier remains, making a **structural**
-claim about the query that resonance cannot state. It reads the response's
-**wide candidate list** (`Precomputed.wideResonance`, §14.5) — the ranked hits,
-widened to an exhaustive index scan only when the top hit clears the concept
-threshold. When the query gist has no concept-level match to anything stored, an
-exhaustive scan would only score more vectors below the bar (profiled at 38–40K
-vectors scored per refusing query on a 325K-context store, costing 44% of
-think). Whether the gist ranks _anything_ at concept level is the discriminator
-— corpus size never was. The list is shared response-wide, so whichever
+claim about the query that resonance cannot state. Its proposal source is the
+response's **one top-k read** (`Precomputed.resonance`, §14.5) — the same ranked
+list recall's earlier tiers already consulted, shared response-wide so whichever
 mechanism first-touches it pays once and every later reader is free.
 
+It used to be a **wide** list, widened to an exhaustive index scan whenever the
+top hit cleared the concept threshold. That was removed: the bridge's own
+candidate cap is `2 · recallQueryK`, so the top-k already IS everything it can
+consume, and every proposal is byte-verified downstream (§4.3) — an exhaustive
+scan bought an O(k) need at O(index) cost (profiled: 244K vectors scored per
+refusing query, ~1.5 s, every answer byte-identical to the top-k read). Test/95
+pins its absence.
+
 #### The substitution bridge
 
 **The gap.** A query phrased through a near-synonym of a trained word ("Name the
@@ -5288,16 +5291,14 @@ recallByResonance(query, pre):
             return { bytes: g, accounted: nothing, moves: STEP }
 
     # ── the REFUSAL PATH ─────────────────────────────────────────────
-    # pre.wideResonance() — the response's ONE wide candidate list, shared
-    # by every mechanism that must look past the top-k:
-    #     hits[0].score ≥ CONCEPT_BAR
-    #       ? exhaustive resonate(gistOf(query), hubBound)       # ids only
-    #       : hits                        # the gist ranks nothing at concept
-    #                                     # level, so a wider scan says nothing
+    # pre.resonance() — the response's ONE top-k read, already paid for by
+    # the tiers above.  The bridge caps its own candidates at 2·recallQueryK,
+    # so the top-k is exactly the budget it can consume; there is no wider
+    # list, and every proposal is byte-verified below.
 
     # 3b. substitution / identity bridge
-    bridged ≔ substitutionBridge(query, pre.wideResonance)
-              # anchors: rarest query windows → edgeAncestors, plus wideIds
+    bridged ≔ substitutionBridge(query, ids(pre.resonance))
+              # anchors: rarest query windows → edgeAncestors, plus those ids
               # align byte-for-byte; a mismatch substitutes only under
               # CORROBORATION ∧ GRADED IDENTITY ∧ RAW BALANCE
               # accept when matched+substituted DOMINATES the query, every

package/dist/src/meter.d.ts

@@ -4,7 +4,7 @@
  *  PHASES NEST, AND ARE NOT DISJOINT.  `think` contains every mechanism
  *  phase; a mechanism's `floor` contains whatever shared analysis it
  *  first-touched (`attention`, `weave`); `recall.run` contains
- *  `substitutionBridge`, which contains `recall.exhaustiveResonate`.  Read a
+ *  `substitutionBridge`.  Read a
  *  phase as "wall-clock spent inside this, inclusive" — never sum them and
  *  expect the total.  `CostReport.elapsedMs` is the only whole.
  *
@@ -129,6 +129,13 @@ export declare class Meter {
     /** Nodes popped by those ascents, against their √N·W budget — the counter
      *  that shows whether the walks are deciding early or burning the budget. */
     junctionPops: number;
+    /** Ascents that ended by EXHAUSTING the expansion budget rather than by
+     *  deciding — the walk abstained and the caller silently fell through to a
+     *  lower tier of the ladder (§2.13: a degradation nothing else reports).
+     *  It rises the moment a SHARED budget is drained by an earlier walk, which
+     *  is what makes "this tier answered nothing" distinguishable from "this
+     *  tier never got to look". */
+    junctionBudgetExhausted: number;
     /** Arbitrary byte spans whose distributional company was VSA-bundled from
      *  existing episode halos. */
     spanHalos: number;
@@ -148,9 +155,6 @@ export declare class Meter {
     mechanismRuns: number;
     /** Candidates the decider weighed. */
     candidates: number;
-    /** Candidates refused before the competition for explaining less than 1/W
-     *  of the query — the honesty-density floor (see pipeline.ts `consider`). */
-    thinRejects: number;
     private readonly _phases;
     private readonly _t0;
     /** Every work counter's current value, by name — the snapshot `time`
@@ -159,6 +163,12 @@ export declare class Meter {
     /** Charge `ms`, one call, and a counter delta to a named phase.
      *  Insertion-ordered, so a report reads in execution order. */
     charge(phase: string, ms: number, delta?: Record<string, number>): void;
+    /** Time one SYNCHRONOUS phase.  The sync/async seam (§2.10) is a real
+     *  contract — perception, recognition and the graph search are synchronous —
+     *  so a synchronous layer must not be wrapped in `time`'s promise just to be
+     *  measured: that would make the profiled path await where the unprofiled
+     *  one does not, and a meter never changes what a layer computes. */
+    timeSync<T>(phase: string, fn: () => T): T;
     /** Time one async phase and attribute the work done inside it.  Returns
      *  the awaited value untouched — a meter never changes what a layer
      *  computes, only what is known about it. */

package/dist/src/meter.js

@@ -122,6 +122,13 @@ export class Meter {
     /** Nodes popped by those ascents, against their √N·W budget — the counter
      *  that shows whether the walks are deciding early or burning the budget. */
     junctionPops = 0;
+    /** Ascents that ended by EXHAUSTING the expansion budget rather than by
+     *  deciding — the walk abstained and the caller silently fell through to a
+     *  lower tier of the ladder (§2.13: a degradation nothing else reports).
+     *  It rises the moment a SHARED budget is drained by an earlier walk, which
+     *  is what makes "this tier answered nothing" distinguishable from "this
+     *  tier never got to look". */
+    junctionBudgetExhausted = 0;
     /** Arbitrary byte spans whose distributional company was VSA-bundled from
      *  existing episode halos. */
     spanHalos = 0;
@@ -142,9 +149,6 @@ export class Meter {
     mechanismRuns = 0;
     /** Candidates the decider weighed. */
     candidates = 0;
-    /** Candidates refused before the competition for explaining less than 1/W
-     *  of the query — the honesty-density floor (see pipeline.ts `consider`). */
-    thinRejects = 0;
     // ── Phases ──────────────────────────────────────────────────────────────
     _phases = new Map();
     _t0 = performance.now();
@@ -176,6 +180,26 @@ export class Meter {
             }
         }
     }
+    /** Time one SYNCHRONOUS phase.  The sync/async seam (§2.10) is a real
+     *  contract — perception, recognition and the graph search are synchronous —
+     *  so a synchronous layer must not be wrapped in `time`'s promise just to be
+     *  measured: that would make the profiled path await where the unprofiled
+     *  one does not, and a meter never changes what a layer computes. */
+    timeSync(phase, fn) {
+        const before = this.snapshot();
+        const t = performance.now();
+        try {
+            return fn();
+        }
+        finally {
+            const ms = performance.now() - t;
+            const after = this.snapshot();
+            const delta = {};
+            for (const k of Object.keys(after))
+                delta[k] = after[k] - before[k];
+            this.charge(phase, ms, delta);
+        }
+    }
     /** Time one async phase and attribute the work done inside it.  Returns
      *  the awaited value untouched — a meter never changes what a layer
      *  computes, only what is known about it. */

package/dist/src/mind/attention.js

@@ -12,7 +12,7 @@ import { composeStructuralGist, consensusFloor, dominates, estimatorNoise, } fro
 import { foldTree, gistOf, latin1Key, perceive, read, resolve, } from "./primitives.js";
 import { recognise } from "./recognition.js";
 import { leafIdRun } from "./canonical.js";
-import { corpusN, edgeAncestors, hubBound, sharedReachMemo, } from "./traverse.js";
+import { atomIsHub, corpusN, edgeAncestors, hubBound, sharedReachMemo, } from "./traverse.js";
 import { cachedRead, junctionContainersFrom, junctionSeeds, junctionSynonyms, loadJunctionSynonymSides, walkCache, } from "./junction.js";
 import { indexOf } from "../bytes.js";
 import { rItem, rNode, traceDerivation } from "./trace.js";
@@ -1848,26 +1848,28 @@ async function crossRegionVotes(ctx, query, regions, rvs, k, N, reachMemo, td) {
     // the same container (or a sub-container of it) twice.
     const consumed = new Set();
     let probes = 0;
-    // Once atoms themselves are hubs (N > W²), the cross-region analysis gets
-    // one k·W walk allowance per evidence tier. Without a shared allowance,
-    // each of k candidate pairs spends the full corpus-derived budget and a
-    // cumulative dialogue multiplies bounded work into tens of seconds. Small
-    // corpora retain exhaustive exact traversal: below this same scale the
-    // budget would be smaller than the structures the tests deliberately build.
+    // When atoms themselves are hubs (atomIsHub — a single byte reaches ≥ √N
+    // contexts, §2.8's own predicate), the corpus is large enough that the
+    // cross-region junction walks are dominated by the drift through common
+    // content's ancestry.  Each of k candidate pairs otherwise spends its own
+    // √N·W budget (profiled: 160,210 junction pops, 31% of think at
+    // N = 325,608), and a cumulative dialogue multiplies bounded work into tens
+    // of seconds.  The structural walk is therefore given ONE k·W allowance per
+    // evidence tier, shared across every pair — k pairs × W phrase-scale levels,
+    // the minimal exact check; a pair whose container is not reached within it
+    // falls through to the resonance tier (the ANN proposes what the shallow
+    // walk no longer exhaustively scans, §2.3).
     //
-    // MEASURED 2026-07-29, NOT YET RESOLVED.  This gate never engages at real
-    // scale: on the trained store N = 325,608 with k = 24 and W = 4, so the
-    // threshold is 96³ = 884,736 and a third of a million contexts still runs
-    // unbudgeted at hubBound·W = 2,280 pops PER PAIR — 160,210 junction pops,
-    // 5.9s, 31% of think.  Sharing one hubBound·W allowance across all pairs
-    // instead cuts that to 22,418 pops and 2.6s (think −19%), but is measurably
-    // too tight below ~10³ contexts: test/36 (N = 8, budget 8) loses the
-    // `red circle` binding root and test/14 (N = 120, budget 40) recalls 39/40.
-    // The sharing is the right shape; hubBound·W is the wrong size for it, and
-    // fitting a size to those two points would repeat the mistake the cube
-    // already makes — pricing the gate on the synthetic corpora.
-    const marketScale = k * ctx.space.maxGroup;
-    const corpusScale = N > marketScale ** 3;
+    // Below atomIsHub the store is small and atoms still discriminate, so the
+    // walks keep exhaustive exact traversal (per-walk √N·W) — the shared budget
+    // would otherwise be smaller than the structures the tests deliberately
+    // build.  The gate is the SAME derived predicate the climb already uses for
+    // byte atoms, not a separate corpus-size knob: an earlier `N > (k·W)³` cube
+    // never engaged at real scale (96³ = 884,736 > 325,608), and a "share one
+    // √N·W" experiment was too tight below ~10³ contexts (test/36, test/14) —
+    // both are the same mistake of pricing the gate on corpus size instead of on
+    // the atom-hub scale.
+    const corpusScale = atomIsHub(ctx, N);
     const exactBudget = corpusScale ? { n: k * ctx.space.maxGroup } : undefined;
     const synonymBudget = corpusScale ? { n: k * ctx.space.maxGroup } : undefined;
     for (let a = 0; a < cand.length && probes < k; a++) {

package/dist/src/mind/graph-search.d.ts

@@ -66,6 +66,13 @@ export type GItem = {
      *  because subtraction is more "the point" of its query).  See
      *  {@link liftAnswer}. */
     computed?: boolean;
+    /** Set on the out emitted at a chain's GENUINE FIXPOINT — the one span kind a
+     *  recursive re-cover ({@link GraphSearch.recompleteNode}) may deepen.  The
+     *  re-cover does NOT run here: this marks the span as eligible, and
+     *  {@link GraphSearch.deepen} runs it afterwards on the spans the lightest
+     *  derivation actually CHOSE.  Part of {@link key}, because it decides
+     *  whether the span's final bytes may still change. */
+    fix?: boolean;
 };
 export declare const STEP = 1;
 export declare const CONCEPT = 10;
@@ -87,6 +94,10 @@ export interface Seg {
     /** See the `computed` field of the "out" {@link GItem} — set only for an
      *  extension's derived value, never a genuinely recognised learned form. */
     computed?: boolean;
+    /** See the `fix` field of the "out" {@link GItem} — this span ended a chain at
+     *  a genuine fixpoint, so it is the one span kind a recursive re-cover may
+     *  still deepen.  Consumed by {@link GraphSearch.deepen}. */
+    fix?: boolean;
 }
 /** One rule application inside the cover's lightest derivation — the FINEST
  *  grain of Sema's core reasoning, one node of the adapted A*LD proof tree.  `move`
@@ -192,6 +203,20 @@ export declare class GraphSearch {
      *  decomposes, two recomposes, any mix — and stops only when it reaches a node
      *  that leads nowhere new, never at an arbitrary count. */
     private solve;
+    /** Re-cover the CHOSEN fixpoint spans, in place.
+     *
+     *  Completion is still "cover, recursively" — it just runs on the answer
+     *  instead of on the exploration.  A cover chooses O(segs) spans, so a level
+     *  pays O(answer) re-covers however densely the corpus interconnects the forms
+     *  the search passed through on the way.  That is the bound
+     *  {@link recompleteNode}'s contract always claimed and, running per fixpoint
+     *  REACHED, never had.
+     *
+     *  Deepening cannot change which cover won: the derivation is already final
+     *  and every span keeps its i..j and its cost.  It only replaces a chosen
+     *  span's bytes with the deeper learnt form they rewrite to — what the
+     *  recursion was always for. */
+    private deepen;
     /** The weighted deduction system the graph exploration solves (the four
      *  reductions of adapted A*LD live in {@link lightestDerivation}; this only states the
      *  items, axioms, goal, and rules — see {@link GItem} for the item kinds).
@@ -253,20 +278,29 @@ export declare class GraphSearch {
      *  ({@link resolve}) — the graph itself gates against re-expanding a contained
      *  form ("ice is cold" ⊅→ "ice is cold is cold").
      *
-     *  Termination is INTRINSIC, not a depth limit: a node already on the
-     *  completion stack ({@link recompleteOpen}) is not re-entered — a self-
-     *  referential recomposition is a cycle that can yield nothing new, so it
-     *  stops there, exactly as {@link completeForward} stops on a revisited edge.
-     *  Distinct node ids are finite and each finished completion is memoised, so a
-     *  legitimate chain runs as deep as the graph licenses and no further. */
+     *  Termination is STRUCTURAL: a produced node is re-covered once, never inside
+     *  another re-cover (see the guard below), so one cover pays at most one
+     *  nested {@link solve} per distinct produced node it actually reaches, and
+     *  {@link recompleteMemo} collapses a repeat to nothing.
+     *
+     *  This comment used to argue termination from "distinct node ids are finite
+     *  and each finished completion is memoised".  That is a bound of N — the one
+     *  AGENTS §2.8 forbids — and it was load-bearing, not pedantic: nested, the
+     *  recursion reached depth 331 and 9.1 GB on an 18.9M-node store for a 2-byte
+     *  query and did not terminate, which is what killed a 5 h training run at its
+     *  checkpoint recall.  Guard: test/89-completion-recursion.test.mjs. */
     private recompleteNode;
     /** Per-cover memo of each produced node's completion (so the many terminal
      *  outs of a long query re-cover each distinct node at most once); reset at the
      *  top of {@link cover}. */
     private recompleteMemo;
-    /** The nodes currently being re-completed — the recursion stack.  A node in
-     *  this set is not re-entered, so a cyclic recomposition terminates naturally
-     *  (the same cycle guard {@link completeForward} uses), with no depth cap. */
+    /** The node currently being re-completed — the recursion stack, and so also
+     *  the nesting depth.  {@link recompleteNode} refuses to start while it is
+     *  non-empty (one re-cover per produced node, never one inside another), which
+     *  is what keeps a query's cost proportional to its answer rather than to the
+     *  corpus; it therefore holds at most one id.  A Set, not a flag, because it
+     *  states WHICH node is open — the invariant a reader needs to check the
+     *  guard, and what makes the old cycle-guard reading still hold. */
     private recompleteOpen;
     /** out(i,j,bytes,…): index it for the binary rules, then offer splicing a
      *  learnt connector (the in-search bridge), splitting (at a sub-leaf form

package/dist/src/mind/graph-search.js

@@ -64,6 +64,7 @@ function readCover(derivation) {
                 rec: out.rec,
                 node: out.node,
                 computed: out.computed,
+                fix: out.fix,
             });
         }
         node = node.premises[0];
@@ -269,9 +270,32 @@ export class GraphSearch {
             onDerivation(readDerivation(derivation, substitutions !== undefined));
         }
         return derivation
-            ? { segs: readCover(derivation), cost: derivation.cost }
+            ? { segs: this.deepen(readCover(derivation)), cost: derivation.cost }
             : null;
     }
+    /** Re-cover the CHOSEN fixpoint spans, in place.
+     *
+     *  Completion is still "cover, recursively" — it just runs on the answer
+     *  instead of on the exploration.  A cover chooses O(segs) spans, so a level
+     *  pays O(answer) re-covers however densely the corpus interconnects the forms
+     *  the search passed through on the way.  That is the bound
+     *  {@link recompleteNode}'s contract always claimed and, running per fixpoint
+     *  REACHED, never had.
+     *
+     *  Deepening cannot change which cover won: the derivation is already final
+     *  and every span keeps its i..j and its cost.  It only replaces a chosen
+     *  span's bytes with the deeper learnt form they rewrite to — what the
+     *  recursion was always for. */
+    deepen(segs) {
+        for (const s of segs) {
+            if (!s.fix || s.node === undefined)
+                continue;
+            const deeper = this.recompleteNode(s.node);
+            if (deeper !== null)
+                s.bytes = deeper;
+        }
+        return segs;
+    }
     /** The weighted deduction system the graph exploration solves (the four
      *  reductions of adapted A*LD live in {@link lightestDerivation}; this only states the
      *  items, axioms, goal, and rules — see {@link GItem} for the item kinds).
@@ -319,7 +343,7 @@ export class GraphSearch {
                 if (it.kind === "form") {
                     return `f${it.i}.${it.j}.${it.node}.${it.via ? 1 : 0}.${it.rcmp ? 1 : 0}`;
                 }
-                return `o${it.i}.${it.j}.${it.cover ? 1 : 0}.${it.rec ? 1 : 0}.${it.node ?? -1}.${latin1(it.bytes)}`;
+                return `o${it.i}.${it.j}.${it.cover ? 1 : 0}.${it.rec ? 1 : 0}.${it.fix ? 1 : 0}.${it.node ?? -1}.${latin1(it.bytes)}`;
             },
             *axioms() {
                 yield { item: { kind: "cover", p: 0 }, cost: 0 };
@@ -614,17 +638,29 @@ export class GraphSearch {
             // actual end, never per intermediate stop — so its cost tracks the
             // ANSWER's own structure, not how densely the corpus interconnects
             // the nodes passed through on the way there.
-            const deeper = this.recompleteNode(it.node);
+            // MARK the fixpoint; do not re-cover it here.  Re-covering at this point
+            // pays a full {@link recompleteNode} — a recognition of the node's whole
+            // bytes — for every fixpoint the exploration REACHES, and how many it
+            // reaches is set by how densely the corpus interconnects the forms passed
+            // through.  Measured on an 18.9M-node store, a 2-byte query: 12,000
+            // re-covers inside ONE cover, folding 95,258 distinct spans, ~2.4 GB and
+            // climbing to a V8 fatal.  The answer needs a handful.
+            //
+            // {@link deepen} runs it instead on the spans the lightest derivation
+            // CHOSE.  The ladder is untouched — this out still costs 0, so a genuine
+            // fixpoint still beats any premature stop at the same depth, exactly as
+            // the ordering above states.
             yield {
                 premises: [it],
                 conclusion: {
                     kind: "out",
                     i: it.i,
                     j: it.j,
-                    bytes: deeper ?? nodeBytes(it.node),
+                    bytes: nodeBytes(it.node),
                     cover: true,
                     rec: true,
                     node: it.node,
+                    fix: true,
                 },
                 cost: 0,
             };
@@ -694,20 +730,47 @@ export class GraphSearch {
      *  ({@link resolve}) — the graph itself gates against re-expanding a contained
      *  form ("ice is cold" ⊅→ "ice is cold is cold").
      *
-     *  Termination is INTRINSIC, not a depth limit: a node already on the
-     *  completion stack ({@link recompleteOpen}) is not re-entered — a self-
-     *  referential recomposition is a cycle that can yield nothing new, so it
-     *  stops there, exactly as {@link completeForward} stops on a revisited edge.
-     *  Distinct node ids are finite and each finished completion is memoised, so a
-     *  legitimate chain runs as deep as the graph licenses and no further. */
+     *  Termination is STRUCTURAL: a produced node is re-covered once, never inside
+     *  another re-cover (see the guard below), so one cover pays at most one
+     *  nested {@link solve} per distinct produced node it actually reaches, and
+     *  {@link recompleteMemo} collapses a repeat to nothing.
+     *
+     *  This comment used to argue termination from "distinct node ids are finite
+     *  and each finished completion is memoised".  That is a bound of N — the one
+     *  AGENTS §2.8 forbids — and it was load-bearing, not pedantic: nested, the
+     *  recursion reached depth 331 and 9.1 GB on an 18.9M-node store for a 2-byte
+     *  query and did not terminate, which is what killed a 5 h training run at its
+     *  checkpoint recall.  Guard: test/89-completion-recursion.test.mjs. */
     recompleteNode(node) {
         if (!this.host.recogniseSpan)
             return null;
         const memo = this.recompleteMemo;
         if (memo.has(node))
             return memo.get(node) ?? null;
-        // Cycle guard: a node being completed must not recurse back into itself.
-        if (this.recompleteOpen.has(node))
+        // ONE re-cover per produced node — never a re-cover inside a re-cover.
+        //
+        // Re-covering is how a PRODUCED node's bytes enter the search at all: the
+        // cover machinery otherwise only ever sees the QUERY's spans.  That is
+        // needed once.  The alternation of decomposition and recomposition that
+        // follows — parts rewriting several times, siblings fusing, a recomposition
+        // feeding another — is the main search's own fuse/`rcmp` work, not this
+        // recursion's: 15-decomposition-gap §9–§12 all pass with this method
+        // disabled outright, and only §6 (the produced composite "p1 p2", whose
+        // bytes nothing else brings in) needs it.
+        //
+        // Nesting it was the defect.  Each level is a full {@link solve} with its
+        // own agenda and chart, exploring from a node the answer never asked about,
+        // so per-query cost tracked how densely the corpus interconnects the forms
+        // passed through — the growth AGENTS §2.8 forbids.  Measured on an
+        // 18.9M-node store: depth 331 and 9.1 GB for a 2-byte query, not
+        // terminating; and on the guard corpus every one of 125 nested re-covers
+        // was REJECTED by the resolve() gate below, expanding a 70-byte node into a
+        // 374-byte concatenation that names nothing.  All of it was waste.
+        //
+        // `recompleteOpen` is that stack, so a non-empty stack means we are already
+        // inside one.  This subsumes the old cycle guard: a node cannot recurse
+        // back into itself when nothing recurses at all.
+        if (this.recompleteOpen.size > 0)
             return null;
         // A leaf or single-child node has no parts to recompose; skip before the
         // costly recognition so a plain terminal answer pays nothing.
@@ -740,9 +803,13 @@ export class GraphSearch {
      *  outs of a long query re-cover each distinct node at most once); reset at the
      *  top of {@link cover}. */
     recompleteMemo = new Map();
-    /** The nodes currently being re-completed — the recursion stack.  A node in
-     *  this set is not re-entered, so a cyclic recomposition terminates naturally
-     *  (the same cycle guard {@link completeForward} uses), with no depth cap. */
+    /** The node currently being re-completed — the recursion stack, and so also
+     *  the nesting depth.  {@link recompleteNode} refuses to start while it is
+     *  non-empty (one re-cover per produced node, never one inside another), which
+     *  is what keeps a query's cost proportional to its answer rather than to the
+     *  corpus; it therefore holds at most one id.  A Set, not a flag, because it
+     *  states WHICH node is open — the invariant a reader needs to check the
+     *  guard, and what makes the old cycle-guard reading still hold. */
     recompleteOpen = new Set();
     /** out(i,j,bytes,…): index it for the binary rules, then offer splicing a
      *  learnt connector (the in-search bridge), splitting (at a sub-leaf form