@hviana/sema 0.6.0 → 0.7.2

package/dist/src/store.js

@@ -723,7 +723,28 @@ export class AbstractStore {
             parts.push(child);
             got += child.length;
         }
-        return concat(parts);
+        const out = concat(parts);
+        // Cache the BRANCH too, not just the leaf above.  Reconstruction is a pure
+        // function of the store, so this is a transparent cache in the strict sense
+        // — an eviction costs a re-walk and nothing else — which is exactly what
+        // `_bytesCache`'s "smallest"/"clock" configuration is for.
+        //
+        // Caching only leaves made every branch re-walk its whole subtree on every
+        // request, and the DAG is hash-consed, so the same children recur under many
+        // parents.  Measured on the 18.9M-node store, ONE 1,314-byte query:
+        // 20,021,474 `_prefix` calls over 469,083 distinct ids (42.7x reuse) to
+        // produce 87,789 results — 97.7% of the work re-derived bytes it had already
+        // built.  One single-byte leaf was reconstructed 2,599,984 times.  Measuring
+        // reuse at the TOP level only shows 1.1x and hides all of it.
+        //
+        // Only a COMPLETE reconstruction may be cached: `_prefix` is also called
+        // with a cap, and a truncated prefix stored under `id` would be served as
+        // if it were the node's whole content by the `_bytesCache` hit above.
+        // `got < maxLen` is that proof — the walk ran out of children before it ran
+        // out of budget, so nothing below was truncated either.
+        if (got < maxLen)
+            this._bytesCache.set(id, out);
+        return out;
     }
     contentLen(id, cap = Infinity) {
         if (this.meter)

package/jsr.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://jsr.io/schema/config-file.v1.json",
   "name": "@hviana/sema",
-  "version": "0.6.0",
+  "version": "0.7.2",
   "exports": "./src/index.ts"
 }

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@hviana/sema",
-  "version": "0.6.0",
+  "version": "0.7.2",
   "description": "Sema: a non-parametric, instance-based reasoning system.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hviana/sema.git"
+  },
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
@@ -14,7 +18,8 @@
   "scripts": {
     "build": "tsc",
     "demo": "tsc && node dist/example/demo.js",
-    "test": "tsc && node --test test/**/*.test.mjs"
+    "test": "tsc && node --test test/**/*.test.mjs",
+    "prepublishOnly": "npm test"
   },
   "license": "PolyForm-Noncommercial-1.0.0",
   "devDependencies": {

package/src/meter.ts

@@ -32,7 +32,7 @@
  *  PHASES NEST, AND ARE NOT DISJOINT.  `think` contains every mechanism
  *  phase; a mechanism's `floor` contains whatever shared analysis it
  *  first-touched (`attention`, `weave`); `recall.run` contains
- *  `substitutionBridge`, which contains `recall.exhaustiveResonate`.  Read a
+ *  `substitutionBridge`.  Read a
  *  phase as "wall-clock spent inside this, inclusive" — never sum them and
  *  expect the total.  `CostReport.elapsedMs` is the only whole.
  *
@@ -176,6 +176,13 @@ export class Meter {
   /** Nodes popped by those ascents, against their √N·W budget — the counter
    *  that shows whether the walks are deciding early or burning the budget. */
   junctionPops = 0;
+  /** Ascents that ended by EXHAUSTING the expansion budget rather than by
+   *  deciding — the walk abstained and the caller silently fell through to a
+   *  lower tier of the ladder (§2.13: a degradation nothing else reports).
+   *  It rises the moment a SHARED budget is drained by an earlier walk, which
+   *  is what makes "this tier answered nothing" distinguishable from "this
+   *  tier never got to look". */
+  junctionBudgetExhausted = 0;
   /** Arbitrary byte spans whose distributional company was VSA-bundled from
    *  existing episode halos. */
   spanHalos = 0;
@@ -198,9 +205,6 @@ export class Meter {
   mechanismRuns = 0;
   /** Candidates the decider weighed. */
   candidates = 0;
-  /** Candidates refused before the competition for explaining less than 1/W
-   *  of the query — the honesty-density floor (see pipeline.ts `consider`). */
-  thinRejects = 0;
 
   // ── Phases ──────────────────────────────────────────────────────────────
 
@@ -234,6 +238,25 @@ export class Meter {
     }
   }
 
+  /** Time one SYNCHRONOUS phase.  The sync/async seam (§2.10) is a real
+   *  contract — perception, recognition and the graph search are synchronous —
+   *  so a synchronous layer must not be wrapped in `time`'s promise just to be
+   *  measured: that would make the profiled path await where the unprofiled
+   *  one does not, and a meter never changes what a layer computes. */
+  timeSync<T>(phase: string, fn: () => T): T {
+    const before = this.snapshot();
+    const t = performance.now();
+    try {
+      return fn();
+    } finally {
+      const ms = performance.now() - t;
+      const after = this.snapshot();
+      const delta: Record<string, number> = {};
+      for (const k of Object.keys(after)) delta[k] = after[k] - before[k];
+      this.charge(phase, ms, delta);
+    }
+  }
+
   /** Time one async phase and attribute the work done inside it.  Returns
    *  the awaited value untouched — a meter never changes what a layer
    *  computes, only what is known about it. */

package/src/mind/attention.ts

@@ -45,6 +45,7 @@ import {
 import { recognise } from "./recognition.js";
 import { leafIdRun } from "./canonical.js";
 import {
+  atomIsHub,
   corpusN,
   edgeAncestors,
   hubBound,
@@ -2647,26 +2648,28 @@ async function crossRegionVotes(
   // the same container (or a sub-container of it) twice.
   const consumed = new Set<number>();
   let probes = 0;
-  // Once atoms themselves are hubs (N > W²), the cross-region analysis gets
-  // one k·W walk allowance per evidence tier. Without a shared allowance,
-  // each of k candidate pairs spends the full corpus-derived budget and a
-  // cumulative dialogue multiplies bounded work into tens of seconds. Small
-  // corpora retain exhaustive exact traversal: below this same scale the
-  // budget would be smaller than the structures the tests deliberately build.
+  // When atoms themselves are hubs (atomIsHub — a single byte reaches ≥ √N
+  // contexts, §2.8's own predicate), the corpus is large enough that the
+  // cross-region junction walks are dominated by the drift through common
+  // content's ancestry.  Each of k candidate pairs otherwise spends its own
+  // √N·W budget (profiled: 160,210 junction pops, 31% of think at
+  // N = 325,608), and a cumulative dialogue multiplies bounded work into tens
+  // of seconds.  The structural walk is therefore given ONE k·W allowance per
+  // evidence tier, shared across every pair — k pairs × W phrase-scale levels,
+  // the minimal exact check; a pair whose container is not reached within it
+  // falls through to the resonance tier (the ANN proposes what the shallow
+  // walk no longer exhaustively scans, §2.3).
   //
-  // MEASURED 2026-07-29, NOT YET RESOLVED.  This gate never engages at real
-  // scale: on the trained store N = 325,608 with k = 24 and W = 4, so the
-  // threshold is 96³ = 884,736 and a third of a million contexts still runs
-  // unbudgeted at hubBound·W = 2,280 pops PER PAIR — 160,210 junction pops,
-  // 5.9s, 31% of think.  Sharing one hubBound·W allowance across all pairs
-  // instead cuts that to 22,418 pops and 2.6s (think −19%), but is measurably
-  // too tight below ~10³ contexts: test/36 (N = 8, budget 8) loses the
-  // `red circle` binding root and test/14 (N = 120, budget 40) recalls 39/40.
-  // The sharing is the right shape; hubBound·W is the wrong size for it, and
-  // fitting a size to those two points would repeat the mistake the cube
-  // already makes — pricing the gate on the synthetic corpora.
-  const marketScale = k * ctx.space.maxGroup;
-  const corpusScale = N > marketScale ** 3;
+  // Below atomIsHub the store is small and atoms still discriminate, so the
+  // walks keep exhaustive exact traversal (per-walk √N·W) — the shared budget
+  // would otherwise be smaller than the structures the tests deliberately
+  // build.  The gate is the SAME derived predicate the climb already uses for
+  // byte atoms, not a separate corpus-size knob: an earlier `N > (k·W)³` cube
+  // never engaged at real scale (96³ = 884,736 > 325,608), and a "share one
+  // √N·W" experiment was too tight below ~10³ contexts (test/36, test/14) —
+  // both are the same mistake of pricing the gate on corpus size instead of on
+  // the atom-hub scale.
+  const corpusScale = atomIsHub(ctx, N);
   const exactBudget = corpusScale ? { n: k * ctx.space.maxGroup } : undefined;
   const synonymBudget = corpusScale ? { n: k * ctx.space.maxGroup } : undefined;
 

package/src/mind/graph-search.ts

@@ -108,6 +108,13 @@ export type GItem =
      *  because subtraction is more "the point" of its query).  See
      *  {@link liftAnswer}. */
     computed?: boolean;
+    /** Set on the out emitted at a chain's GENUINE FIXPOINT — the one span kind a
+     *  recursive re-cover ({@link GraphSearch.recompleteNode}) may deepen.  The
+     *  re-cover does NOT run here: this marks the span as eligible, and
+     *  {@link GraphSearch.deepen} runs it afterwards on the spans the lightest
+     *  derivation actually CHOSE.  Part of {@link key}, because it decides
+     *  whether the span's final bytes may still change. */
+    fix?: boolean;
   };
 type OutItem = Extract<GItem, { kind: "out" }>;
 
@@ -153,6 +160,10 @@ export interface Seg {
   /** See the `computed` field of the "out" {@link GItem} — set only for an
    *  extension's derived value, never a genuinely recognised learned form. */
   computed?: boolean;
+  /** See the `fix` field of the "out" {@link GItem} — this span ended a chain at
+   *  a genuine fixpoint, so it is the one span kind a recursive re-cover may
+   *  still deepen.  Consumed by {@link GraphSearch.deepen}. */
+  fix?: boolean;
 }
 
 /** Read the chosen spans back off a derivation: the goal is a chain of bridge
@@ -171,6 +182,7 @@ function readCover(derivation: Derivation<GItem>): Seg[] {
         rec: out.rec,
         node: out.node,
         computed: out.computed,
+        fix: out.fix,
       });
     }
     node = node.premises[0];
@@ -472,10 +484,32 @@ export class GraphSearch {
       onDerivation(readDerivation(derivation, substitutions !== undefined));
     }
     return derivation
-      ? { segs: readCover(derivation), cost: derivation.cost }
+      ? { segs: this.deepen(readCover(derivation)), cost: derivation.cost }
       : null;
   }
 
+  /** Re-cover the CHOSEN fixpoint spans, in place.
+   *
+   *  Completion is still "cover, recursively" — it just runs on the answer
+   *  instead of on the exploration.  A cover chooses O(segs) spans, so a level
+   *  pays O(answer) re-covers however densely the corpus interconnects the forms
+   *  the search passed through on the way.  That is the bound
+   *  {@link recompleteNode}'s contract always claimed and, running per fixpoint
+   *  REACHED, never had.
+   *
+   *  Deepening cannot change which cover won: the derivation is already final
+   *  and every span keeps its i..j and its cost.  It only replaces a chosen
+   *  span's bytes with the deeper learnt form they rewrite to — what the
+   *  recursion was always for. */
+  private deepen(segs: Seg[]): Seg[] {
+    for (const s of segs) {
+      if (!s.fix || s.node === undefined) continue;
+      const deeper = this.recompleteNode(s.node);
+      if (deeper !== null) s.bytes = deeper;
+    }
+    return segs;
+  }
+
   /** The weighted deduction system the graph exploration solves (the four
    *  reductions of adapted A*LD live in {@link lightestDerivation}; this only states the
    *  items, axioms, goal, and rules — see {@link GItem} for the item kinds).
@@ -541,8 +575,8 @@ export class GraphSearch {
           }`;
         }
         return `o${it.i}.${it.j}.${it.cover ? 1 : 0}.${it.rec ? 1 : 0}.${
-          it.node ?? -1
-        }.${latin1(it.bytes)}`;
+          it.fix ? 1 : 0
+        }.${it.node ?? -1}.${latin1(it.bytes)}`;
       },
       *axioms() {
         yield { item: { kind: "cover", p: 0 }, cost: 0 };
@@ -855,17 +889,29 @@ export class GraphSearch {
       // actual end, never per intermediate stop — so its cost tracks the
       // ANSWER's own structure, not how densely the corpus interconnects
       // the nodes passed through on the way there.
-      const deeper = this.recompleteNode(it.node);
+      // MARK the fixpoint; do not re-cover it here.  Re-covering at this point
+      // pays a full {@link recompleteNode} — a recognition of the node's whole
+      // bytes — for every fixpoint the exploration REACHES, and how many it
+      // reaches is set by how densely the corpus interconnects the forms passed
+      // through.  Measured on an 18.9M-node store, a 2-byte query: 12,000
+      // re-covers inside ONE cover, folding 95,258 distinct spans, ~2.4 GB and
+      // climbing to a V8 fatal.  The answer needs a handful.
+      //
+      // {@link deepen} runs it instead on the spans the lightest derivation
+      // CHOSE.  The ladder is untouched — this out still costs 0, so a genuine
+      // fixpoint still beats any premature stop at the same depth, exactly as
+      // the ordering above states.
       yield {
         premises: [it],
         conclusion: {
           kind: "out",
           i: it.i,
           j: it.j,
-          bytes: deeper ?? nodeBytes(it.node),
+          bytes: nodeBytes(it.node),
           cover: true,
           rec: true,
           node: it.node,
+          fix: true,
         },
         cost: 0,
       };
@@ -936,18 +982,45 @@ export class GraphSearch {
    *  ({@link resolve}) — the graph itself gates against re-expanding a contained
    *  form ("ice is cold" ⊅→ "ice is cold is cold").
    *
-   *  Termination is INTRINSIC, not a depth limit: a node already on the
-   *  completion stack ({@link recompleteOpen}) is not re-entered — a self-
-   *  referential recomposition is a cycle that can yield nothing new, so it
-   *  stops there, exactly as {@link completeForward} stops on a revisited edge.
-   *  Distinct node ids are finite and each finished completion is memoised, so a
-   *  legitimate chain runs as deep as the graph licenses and no further. */
+   *  Termination is STRUCTURAL: a produced node is re-covered once, never inside
+   *  another re-cover (see the guard below), so one cover pays at most one
+   *  nested {@link solve} per distinct produced node it actually reaches, and
+   *  {@link recompleteMemo} collapses a repeat to nothing.
+   *
+   *  This comment used to argue termination from "distinct node ids are finite
+   *  and each finished completion is memoised".  That is a bound of N — the one
+   *  AGENTS §2.8 forbids — and it was load-bearing, not pedantic: nested, the
+   *  recursion reached depth 331 and 9.1 GB on an 18.9M-node store for a 2-byte
+   *  query and did not terminate, which is what killed a 5 h training run at its
+   *  checkpoint recall.  Guard: test/89-completion-recursion.test.mjs. */
   private recompleteNode(node: number): Uint8Array | null {
     if (!this.host.recogniseSpan) return null;
     const memo = this.recompleteMemo;
     if (memo.has(node)) return memo.get(node) ?? null;
-    // Cycle guard: a node being completed must not recurse back into itself.
-    if (this.recompleteOpen.has(node)) return null;
+    // ONE re-cover per produced node — never a re-cover inside a re-cover.
+    //
+    // Re-covering is how a PRODUCED node's bytes enter the search at all: the
+    // cover machinery otherwise only ever sees the QUERY's spans.  That is
+    // needed once.  The alternation of decomposition and recomposition that
+    // follows — parts rewriting several times, siblings fusing, a recomposition
+    // feeding another — is the main search's own fuse/`rcmp` work, not this
+    // recursion's: 15-decomposition-gap §9–§12 all pass with this method
+    // disabled outright, and only §6 (the produced composite "p1 p2", whose
+    // bytes nothing else brings in) needs it.
+    //
+    // Nesting it was the defect.  Each level is a full {@link solve} with its
+    // own agenda and chart, exploring from a node the answer never asked about,
+    // so per-query cost tracked how densely the corpus interconnects the forms
+    // passed through — the growth AGENTS §2.8 forbids.  Measured on an
+    // 18.9M-node store: depth 331 and 9.1 GB for a 2-byte query, not
+    // terminating; and on the guard corpus every one of 125 nested re-covers
+    // was REJECTED by the resolve() gate below, expanding a 70-byte node into a
+    // 374-byte concatenation that names nothing.  All of it was waste.
+    //
+    // `recompleteOpen` is that stack, so a non-empty stack means we are already
+    // inside one.  This subsumes the old cycle guard: a node cannot recurse
+    // back into itself when nothing recurses at all.
+    if (this.recompleteOpen.size > 0) return null;
 
     // A leaf or single-child node has no parts to recompose; skip before the
     // costly recognition so a plain terminal answer pays nothing.
@@ -985,9 +1058,13 @@ export class GraphSearch {
    *  outs of a long query re-cover each distinct node at most once); reset at the
    *  top of {@link cover}. */
   private recompleteMemo = new Map<number, Uint8Array | null>();
-  /** The nodes currently being re-completed — the recursion stack.  A node in
-   *  this set is not re-entered, so a cyclic recomposition terminates naturally
-   *  (the same cycle guard {@link completeForward} uses), with no depth cap. */
+  /** The node currently being re-completed — the recursion stack, and so also
+   *  the nesting depth.  {@link recompleteNode} refuses to start while it is
+   *  non-empty (one re-cover per produced node, never one inside another), which
+   *  is what keeps a query's cost proportional to its answer rather than to the
+   *  corpus; it therefore holds at most one id.  A Set, not a flag, because it
+   *  states WHICH node is open — the invariant a reader needs to check the
+   *  guard, and what makes the old cycle-guard reading still hold. */
   private recompleteOpen = new Set<number>();
 
   /** out(i,j,bytes,…): index it for the binary rules, then offer splicing a

package/src/mind/junction.ts

@@ -207,6 +207,19 @@ function cachedContainers(
  *     edgeAncestors' question and wrong for this one: a junction container
  *     is legitimately reached across many containing structures.  Half the
  *     successful junctions would be lost.
+ *
+ *     REFUTED EARLY-STOP (side-cone exhaustion, §2.17's "real saturation"):
+ *     stopping the walk the moment ONE side's upward cone is emptied is wrong,
+ *     in both a hub-guarded form and a hub-flagged form.  The junction test is
+ *     a BYTE containment over the UNION of the two cones, and a junction can be
+ *     structurally reachable from only ONE side — the side whose seed is a
+ *     FOLD sub-node of the container (test/16: "cold or hot" is reached from
+ *     the window "cold", but the 3-byte answer "hot" is not a 4-byte window of
+ *     it, so "hot"'s cone is empty while the junction still lies ahead in
+ *     "cold"'s cone; test/34's n-ary binding fails the hub-guarded form the
+ *     same way).  "One cone exhausted" therefore never proves "no junction
+ *     left", and the walk must keep the √N·W budget as its NET after the
+ *     per-node saturations below.
  *   • per-node hub guards — parent fan-outs beyond √N are hubs (not
  *     expanded); each node contributes at most one √N page of containers;
  *     √N collected candidates decide. */
@@ -251,7 +264,18 @@ export function junctionContainersFrom(
     id,
     d: 0,
   }));
-  while (stack.length > 0 && out.length < bound && b.n-- > 0) {
+  while (stack.length > 0 && out.length < bound) {
+    // BUDGET EXHAUSTION IS AN ABSTENTION, AND IT MUST BE VISIBLE (§2.13).  The
+    // walk stops with work still on the stack, the caller reads "no container"
+    // and falls through to a lower ladder rung — indistinguishable, from the
+    // outside, from a walk that looked everywhere and found nothing.  With a
+    // SHARED budget (cross-region's one k·W allowance per tier) an EARLIER
+    // pair can drain it, so a later pair's exact tier may never run at all;
+    // this counter is the only thing that says so.
+    if (b.n-- <= 0) {
+      if (ctx.meter) ctx.meter.junctionBudgetExhausted++;
+      break;
+    }
     const { id: x, d } = stack.pop()!;
     if (ctx.meter) ctx.meter.junctionPops++;
     const f = cachedRead(ctx, cache, x, maxContainer);

package/src/mind/mechanisms/cover.ts

@@ -59,7 +59,9 @@ export async function resolveConnectors(
   // transcript evidence: cover still needs the site for structural context,
   // but liftAnswer will trim that continuation as already answered. Building
   // pairwise/n-ary bridges for it can only create connectors that are later
-  // discarded, and on cumulative dialogue that dominated the whole search.
+  // discarded — a semantically neutral gate (it removes work whose product
+  // liftAnswer throws away), and a cumulative (multi-turn) query is exactly
+  // where such already-answered continuations recur.
   let answered = 0;
   const ordered = [...sites]
     .sort((a, b) => a.start - b.start)
@@ -72,9 +74,26 @@ export async function resolveConnectors(
       if (span && span[0] <= s.start && s.end <= span[1]) return false;
       if (query === undefined || ctx.answeredSpans.length === 0) return true;
       const continuations = ctx.store.nextFirst(s.payload, hubBound(ctx));
-      return !continuations.some((answer) =>
-        indexOf(query, read(ctx, answer), 0) >= 0
-      );
+      return !continuations.some((answer) => {
+        // PREFIX-CAPPED (AGENTS §2.8): a candidate longer than the query cannot
+        // occur INSIDE it, so read one byte past the query's length — enough to
+        // detect the overflow — and reject without reconstructing the rest.
+        // The `+ 1` is what makes the test exact rather than a truncation: a
+        // result of exactly `query.length + 1` bytes is known to be too long,
+        // and anything shorter is the candidate's COMPLETE content, so the
+        // substring test below is the same test as before.  (The same overflow
+        // probe bridge.ts:256 already uses.)
+        //
+        // This loop runs up to hubBound(ctx) = √N reads PER SITE, and only on a
+        // multi-turn response — `answeredSpans` is empty for a plain respond(),
+        // so the probe does not execute there.  The cap cannot reduce the read
+        // COUNT — only a semantic change to the "already answered" test could —
+        // but it bounds each read by the query instead of by the corpus, which
+        // is what §2.8 asks for and what rescues a SHORT query: at 3 bytes this
+        // reads 4 bytes per candidate instead of the ~231 it averaged before.
+        const bytes = read(ctx, answer, query.length + 1);
+        return bytes.length <= query.length && indexOf(query, bytes, 0) >= 0;
+      });
     });
   const bridgePair = async (l: number, r: number) => {
     if (l === r || links.has(l + "," + r)) return;

package/src/mind/mechanisms/prefix-completion.ts

@@ -45,15 +45,23 @@
 //      from `resonate(k)` at k = 24, 256 AND 2048 — while forms scoring LOWER
 //      (Germany 0.5670, Yemen 0.5591) are returned.  `k` only reorders WITHIN
 //      the IVF clusters already probed, exactly as Store.resonate's doc warns,
-//      so no k recovers it.  With `exhaustive` it ranks 8.
+//      so no k recovers it.
 //
-// So this is a RETRIEVABILITY gap, not a semantic one, and it is repaired by
-// reading the candidate list recall's refusal path has ALREADY fetched
-// exhaustively for the substitution bridge — never by resonating on its own.
-// Measured cost of the scan over those 570 candidates: 2.9 ms warm, 20.4 ms
-// cold, against a ~700 ms refusal path.  Issuing a FRESH exhaustive call would
-// cost 490 ms median against 13 ms non-exhaustive (36×), which is why this tier
-// takes the candidate list as an argument and adds nothing to it.
+// So this is a RETRIEVABILITY gap, not a semantic one, and the ANN is the wrong
+// instrument for it: a proper prefix's gist cannot rank its own continuation.
+// The repair is CONTENT-ADDRESSED (§2.3) — `formsOpenedBy` (traverse.ts) reads
+// the leaf-id WINDOW index the write side already maintains and answers "which
+// trained forms does this byte run open?" in a bounded √N walk.  That is this
+// mechanism's first supply.  The response's memoised top-k `resonance()` is the
+// second, for prefixes long enough that the gist still ranks the form; it is
+// read, never re-issued.
+//
+// AN EXHAUSTIVE ANN LIST IS NOT A SUPPLY HERE, AND WAS REMOVED.  This tier once
+// read `Precomputed.wideResonance()` — a full-index `resonate(guide, √N,
+// exhaustive)` — on the argument that the target "ranks 8 with `exhaustive`".
+// It bought an O(k) need at O(index) cost (measured: 244K annVectorReads per
+// refusing query, ~1.5 s) for candidates the window index proposes directly.
+// See pipeline-mechanism.ts's REMOVED note; test/95 pins its absence.
 //
 // THREE GUARDS, each falsified into existence by measurement — do not drop any:
 //
@@ -114,7 +122,8 @@ export interface PrefixCompletion {
  *  it, when the continuation is sub-quantum, when a candidate's continuation
  *  cannot be read through, or when the candidates disagree.
  *
- *  `ranked` must be a list the caller has ALREADY fetched; this mechanism never
+ *  `ranked` must be a list the caller has ALREADY fetched (the write side's
+ *  window index, or the response's memoised top-k); this mechanism never
  *  resonates on its own (see the header's cost note). */
 export function prefixCompletion(
   ctx: MindContext,
@@ -251,9 +260,9 @@ export const prefixMechanism: PipelineMechanism = {
   provenance: "prefix",
   async floor(ctx, query, _pre, worthRunning) {
     // One projection: the form is voiced whole, nothing is substituted.
-    // INVESTMENT DISCIPLINE — the supplies below are the response's wide
-    // candidate list and a bounded √N walk, so neither is touched until the
-    // bound can still beat the incumbent.
+    // INVESTMENT DISCIPLINE — the supplies below are a bounded √N window walk
+    // and the response's memoised top-k resonance read, so neither is touched
+    // until the bound can still beat the incumbent.
     if (!worthRunning(STEP)) return STEP;
     // A query with no room for a perceivable continuation inside the phrase
     // cap cannot clear guard 2, so it is not worth a single read.
@@ -264,14 +273,25 @@ export const prefixMechanism: PipelineMechanism = {
     return STEP;
   },
   async run(ctx, query, pre) {
-    // The response's shared wide list first; only when it supplies nothing does
-    // the write side's window index propose.  That ordering is the whole cost
-    // story: a query the ranked list can already explain pays not one extra
-    // read, and the bounded walk is spent only where the alternative is an
-    // empty answer.  A second SUPPLY, not a second mechanism — the same three
-    // guards decide either way.
-    const completed = prefixCompletion(ctx, query, await pre.wideResonance()) ??
-      prefixCompletion(ctx, query, formsOpenedBy(ctx, query));
+    // ONE SUPPLY PASS, not a two-tier `??`.  The window index (exact,
+    // content-addressed) and the response's memoised top-k (approximate) are
+    // concatenated and the three guards decide ONCE over the union.  A
+    // first-then-fallback chain would let the APPROXIMATE tier override the
+    // EXACT one (§2.3): when formsOpenedBy finds two continuations, guard 3
+    // returns null and the fallback re-runs the guards on resonance's top-k
+    // alone — which, seeing only one of the two forms, would voice it.  That is
+    // precisely the disagreement-suppression guard 3 exists to prevent, and it
+    // is the exact tier's ambiguity being washed away by the approximate tier.
+    // Evaluating the union means a disagreement the window index saw can never
+    // be hidden by what the ANN happens to rank.  The ANN read is the
+    // response's ONE memoised top-k (§2.11), already paid by recall's refusal
+    // path on the queries where this mechanism fires, so reading it here is not
+    // a second index scan.
+    const ids = [
+      ...formsOpenedBy(ctx, query),
+      ...(await pre.resonance()).map((h) => h.id),
+    ];
+    const completed = prefixCompletion(ctx, query, ids);
     if (completed === null) return [];
     return [{
       bytes: completed.form,

package/src/mind/mechanisms/recall.ts

@@ -412,10 +412,14 @@ export async function recallByResonance(
     }
   }
   // 3b. Corroborated-substitution bridge — refusal-path only (bridge.ts).
-  // The WIDE candidate list every past-the-top-k mechanism reads lives on
-  // Precomputed (see wideResonance): shared across the whole response, so the
-  // exhaustive branch runs at most once whoever first-touches it.
-  const wideIds = () => pre.wideResonance();
+  // The bridge's proposal source is the response's ONE top-k read — the same
+  // list recall already ranked above — never an exhaustive √N scan.  The
+  // bridge's own candidate cap is 2·recallQueryK, so top-k proposals are
+  // exactly the budget it can consume, and every proposal is byte-verified
+  // downstream (§2.3).  Reuse the memoised `resonance()`; scanning every IVF
+  // cluster here once made every honest refusal cost hundreds of ms regardless
+  // of k.
+  const wideIds = async () => (await pre.resonance()).map((h) => h.id);
 
   // Every gist-based tier has failed; before refusing, align the query
   // byte-for-byte against the trained contexts its own stored windows