@polycode-projects/the-mechanical-code-talker 1.11.0 → 1.11.6

package/src/plan-viz.mjs

@@ -1,13 +1,12 @@
 // plan-viz.mjs — renders a computed plan (result.plan from the chat plan lane)
 // as a self-contained, animated HTML page: the "blocks" archetype.
 //
-// Same factoring as viz.mjs: a pure layout step (computeBlocksLayout) and a
-// pure string builder (renderPlanHtml). No I/O here — callers pass the plan,
-// the class→archetype map (rendersAs), and the size-order pairs; both derive
-// from fact rows at wiring time.
+// A pure layout step (computeBlocksLayout) and a pure string builder
+// (renderPlanHtml). No I/O here — callers pass the plan, the class→archetype
+// map (rendersAs), and the size-order pairs; both derive from fact rows at
+// wiring time.
 
-import { escapeHtml, embedJson } from "./viz.mjs";
-import { THEME_TOKENS_CSS, SERIF_STACK, MONO_STACK } from "./viz-theme.mjs";
+import { THEME_TOKENS_CSS, SERIF_STACK, MONO_STACK, escapeHtml, embedJson } from "./viz-theme.mjs";
 
 const BOARD_W = 640;
 const BOARD_H = 260;

package/src/router/drive.mjs

@@ -10,25 +10,35 @@
 // which are ..." request -> the planner, HTN-decomposed into an ordered call
 // sequence with a POP causal-link proof chain, then folded into ONE composed
 // answer via the same set-algebra the HTN method names (relative-filter ->
-// intersect; conditional -> fallback/guard). A request neither stage can
-// ground escalates to the closed-world goal-reasoner — a maintenance-invariant
-// deduction (coverage-gap / cochange-risk), never a keyword guess. Anything
-// none of the three grounds is an honest refuse, the same "grounded or an
-// honest miss" contract as every other tmct answer path.
+// intersect; conditional -> fallback/guard). A refused WORLD goal ("make every
+// disk rest on peg-c") is tried against the taught capability records next
+// (runTaughtPlan — selected by backward chaining, grounded by pure simulation,
+// never dispatched). A request none of those ground escalates to the
+// closed-world goal-reasoner — a maintenance-invariant deduction
+// (coverage-gap / cochange-risk), never a keyword guess. Anything no stage
+// grounds is an honest refuse, the same "grounded or an honest miss" contract
+// as every other tmct answer path.
 
-import { resolveOne } from "./resolver.mjs";
+import { resolveOne, backwardChainWorld } from "./resolver.mjs";
 import { plan, isMultiStep, decompose, MAX_STEPS } from "./planner.mjs";
 import { goalReason } from "./goal-reasoner.mjs";
 import { capabilities } from "./registry.mjs";
+import { registerTaughtActions } from "./taught.mjs";
 import { intersect, fallbackIfEmpty, guardIfEmpty, memberIndividuals, membersReaching, resultSetOf } from "./results.mjs";
 import { resolveObject } from "../ask.mjs";
 import { parseEntities } from "../codegraph.mjs";
 import { dispatchTool } from "../server.mjs";
 import { ToolError } from "../config.mjs";
+import { loadMemory, readFactRows, readRuleRows } from "../memory/core.mjs";
+import {
+  compileDomain, stateFromFacts, stateKeyFor, movesFromRules, compileGoal, PlanBudgetError,
+} from "../domain.mjs";
+import { findActionPath } from "../planning.mjs";
 import * as defaultSource from "../source.mjs";
 
 export const ROUTER_DRIVER = "resolver-0.8.0";
 export const GOAL_DRIVER = "goal-0.8.1";
+export const TAUGHT_DRIVER = "taught-0.1.0";
 
 /** Every registered capability's name — the default declared toolset for a
  *  caller that doesn't want to hand-pick a subset. */
@@ -138,14 +148,102 @@ export async function runResolverPlan(request, tools, ctx) {
   };
 }
 
-/** The full drive: resolver/planner first; a refusal there escalates to the
- *  closed-world goal-reasoner. Mirrors agentbench's driver-resolver.mjs +
- *  driver-goal.mjs composition, with no agentbench/ dependency (agentbench/
- *  is dev-only, never shipped). Returns a loopResult:
+// ---- the taught world-goal lane -----------------------------------------------
+
+// The one closed world-goal recognizer: "make/get (every|each|all)? <term>
+// <verb>s? <prep> <object>". The preposition set mirrors chat.mjs's PREP_SRC
+// but stays LOCAL and closed — this lane must never widen because a chat
+// frame did, or the two surfaces drift apart silently instead of loudly.
+const WORLD_PREP_SRC = "on|in|at|onto|upon|under|over|beside|near|behind|above|below|inside|outside";
+const WORLD_GOAL_RE = new RegExp(
+  `^(?:make|get)\\s+(?:(every|each|all)\\s+)?([\\w-]+)\\s+([a-z]+?)s?\\s+(${WORLD_PREP_SRC})\\s+([\\w-]+)[.!?\\s]*$`,
+  "i",
+);
+
+/** The taught world-goal lane: recognize "make every disk rest on peg-c",
+ *  backward-chain the goal predicate to a REGISTERED taught capability record
+ *  (the record src/router/taught.mjs bridged in is the thing consumed), then
+ *  ground the move sequence by pure simulation over the taught rules
+ *  (compileDomain + stateFromFacts + compileGoal + findActionPath — all
+ *  read-only). Returned calls are NEVER dispatched: taught records carry
+ *  readOnly:false / dispatchable:false, so the plan is simulated and chat's
+ *  "next" executes move 1. Returns a loopResult, or null when the request is
+ *  not a world-goal shape (the caller falls through to the goal-reasoner). */
+export async function runTaughtPlan(request, tools, ctx) {
+  const m = WORLD_GOAL_RE.exec(String(request || "").trim());
+  if (!m) return null;
+  const universal = Boolean(m[1]);
+  const term = m[2].toLowerCase();
+  const predicate = `${m[3].toLowerCase()}-${m[4].toLowerCase()}`;
+  const object = m[5].toLowerCase();
+
+  const cap = backwardChainWorld(predicate);
+  if (!cap) {
+    return refuse(`the world goal needs a taught action whose effect achieves "${predicate}", and no taught: record with that world-effect is registered — teach the action rules first (honest miss)`, TAUGHT_DRIVER);
+  }
+  if (!tools.includes(cap.name)) {
+    return refuse(`selected ${cap.name} but it is not in the declared toolset`, TAUGHT_DRIVER);
+  }
+  if (!ctx.memoryDir) {
+    return refuse(`${cap.name} plans over a taught memory store, and this context carries none`, TAUGHT_DRIVER);
+  }
+
+  let domain;
+  let state;
+  let isGoal;
+  try {
+    const memory = await loadMemory(ctx.memoryDir);
+    const factRows = readFactRows(memory);
+    domain = compileDomain(factRows, readRuleRows(memory));
+    state = stateFromFacts(factRows, domain);
+    isGoal = compileGoal([{ universal, term, predicate, object }], domain);
+  } catch (e) {
+    return refuse(`the taught domain does not ground this goal: ${e?.message ?? e}`, TAUGHT_DRIVER);
+  }
+  if (!state.length) {
+    return refuse(`no current world state is taught yet — state the board first (e.g. "disk-1 rests on peg-a"), then re-ask`, TAUGHT_DRIVER);
+  }
+  let found;
+  try {
+    found = findActionPath(state, isGoal, (s) => movesFromRules(s, domain), { maxDepth: 300, stateKey: stateKeyFor });
+  } catch (e) {
+    if (e instanceof PlanBudgetError) return refuse(`the taught search space is too large (${e.message}) — narrow the classes involved`, TAUGHT_DRIVER);
+    throw e;
+  }
+  if (!found) {
+    return refuse(`no move sequence within 300 steps reaches the goal from the taught state (honest miss)`, TAUGHT_DRIVER);
+  }
+
+  const calls = found.actions.map((a) => ({ name: `taught:${a.name}`, input: { subject: a.subject, target: a.target } }));
+  for (const c of calls) {
+    if (!tools.includes(c.name)) return refuse(`the plan needs ${c.name}, which is not in the declared toolset`, TAUGHT_DRIVER);
+  }
+  const proof = [
+    { step: "backward-chain", pred: "taught:world-effect", predicate, capability: cap.name, ok: true },
+    ...calls.map((c, i) => ({ step: "effect", pred: "taught:world-effect", predicate, consumer: `step-${i + 1}:${c.name}`, ok: true })),
+  ];
+  const why = [
+    `world goal (${universal ? "every " : ""}${term} ${predicate} ${object}) => backward-chain over taught:world-effect => ${cap.name}`,
+    `grounded by simulation: compileDomain + findActionPath over the taught rules (${calls.length} move${calls.length === 1 ? "" : "s"}, shortest)`,
+  ];
+  return {
+    calls, refused: false, terminated: true, proof, driver: TAUGHT_DRIVER, why,
+    observed: `plan(taught): ${calls.length} move${calls.length === 1 ? "" : "s"} simulated over the taught rules — taught: calls are never dispatched; in chat, "next" executes move 1`,
+  };
+}
+
+/** The full drive: resolver/planner first; a refusal there falls through to
+ *  the taught world-goal lane (runTaughtPlan, above), and only a request that
+ *  is not a world goal escalates to the closed-world goal-reasoner. Mirrors
+ *  agentbench's driver-resolver.mjs + driver-goal.mjs composition, with no
+ *  agentbench/ dependency (agentbench/ is dev-only, never shipped). Returns a
+ *  loopResult:
  *  `{ calls, refused, terminated, proof, why, driver, composed?, observed? }`. */
 export async function runCapabilityPlan(request, tools, ctx) {
   const c1 = await runResolverPlan(request, tools, ctx);
   if (!c1.refused) return c1;
+  const taught = await runTaughtPlan(request, tools, ctx);
+  if (taught) return taught.refused ? { ...taught, c1Why: c1.why } : taught;
   const c2 = await goalReason(request, tools, ctx, { driver: GOAL_DRIVER });
   // Both stages refused: carry the resolver/planner's own reason alongside the
   // goal-reasoner's so a caller can show why the direct route AND the
@@ -163,8 +261,14 @@ export async function runCapabilityPlan(request, tools, ctx) {
  *  Pass an already-parsed `graph` (e.g. a chat session's own) to skip reloading
  *  it — mirrors the config -> source.fetchEntities -> parseEntities chain
  *  dispatchTool runs internally, so a passed-in graph must come from that same
- *  chain to stay consistent. */
-export async function buildCapabilityPlanCtx({ config, source = defaultSource, tel = null, graph = null } = {}) {
+ *  chain to stay consistent.
+ *
+ *  Pass a `memoryDir` to open the taught world-goal lane: the memory store's
+ *  action families are registered as taught: capability records (idempotent —
+ *  an already-registered name is skipped) and runTaughtPlan simulates over the
+ *  same store. The new registrations' unregister disposers ride the ctx as
+ *  `ctx.disposers`; the caller runs them when the ctx is done. */
+export async function buildCapabilityPlanCtx({ config, source = defaultSource, tel = null, graph = null, memoryDir = null } = {}) {
   const g = graph || parseEntities(await source.fetchEntities(config));
   const resolve = (term) => resolveObject(g, term);
   const dispatch = async (name, input) => {
@@ -179,5 +283,10 @@ export async function buildCapabilityPlanCtx({ config, source = defaultSource, t
       throw e;
     }
   };
-  return { dispatch, resolve, graph: g, config };
+  const ctx = { dispatch, resolve, graph: g, config };
+  if (memoryDir) {
+    ctx.memoryDir = memoryDir;
+    ctx.disposers = registerTaughtActions(await loadMemory(memoryDir));
+  }
+  return ctx;
 }

package/src/router/resolver.mjs

@@ -94,6 +94,19 @@ export function backwardChain(topic) {
   return null;
 }
 
+/** Backward-chain a WORLD goal — a state predicate like "rest-on" that a
+ *  taught action's effect establishes — to the registered record whose
+ *  add-list carries the matching taught:world-effect (the bridge
+ *  src/router/taught.mjs registers). Pure over the registry; null when no
+ *  taught record achieves the predicate. The sibling of backwardChain above,
+ *  which only ever matches epistemic `knows` effects. */
+export function backwardChainWorld(predicate) {
+  for (const cap of capabilities()) {
+    if (effectsOf(cap.name).add.some((e) => e.pred === "taught:world-effect" && e.predicate === predicate)) return cap;
+  }
+  return null;
+}
+
 // Stopwords for the imperative-frame entity extractor. Deliberately generous: a wrong
 // pick is caught by the resolveObject miss -> honest refuse, never emitted.
 const STOP = new Set([

package/src/router/taught.mjs

@@ -10,7 +10,7 @@
 import { readRuleRows } from "../memory/core.mjs";
 import { capabilityByName, registerCapability } from "./registry.mjs";
 
-const ACTION_KINDS = new Set(["action-signature", "action-precond", "action-effect"]);
+const ACTION_KINDS = new Set(["action-signature", "action-precond", "action-effect", "action-constraint"]);
 
 /** Group a memory payload's action-family rule rows by rule name. */
 export function actionFamilies(memory) {
@@ -28,6 +28,7 @@ export function capabilityFromActionRules(name, family) {
   const signatures = family.filter((r) => r.kind === "action-signature");
   const preconds = family.filter((r) => r.kind === "action-precond");
   const effects = family.filter((r) => r.kind === "action-effect");
+  const constraints = family.filter((r) => r.kind === "action-constraint");
   return {
     name: `taught:${name}`,
     label: name,
@@ -37,13 +38,23 @@ export function capabilityFromActionRules(name, family) {
       { name: "subject", classes: [...new Set(signatures.map((s) => s.slots.subjectClass))].sort() },
       { name: "target", classes: [...new Set(signatures.map((s) => s.slots.targetClass))].sort() },
     ],
-    preconditions: preconds.map((p) => ({
-      pred: "taught:world-precond",
-      shape: p.slots.shape,
-      predicate: p.slots.predicate,
-      role: p.slots.role,
-      scope: p.slots.scope,
-    })),
+    preconditions: [
+      ...preconds.map((p) => ({
+        pred: "taught:world-precond",
+        shape: p.slots.shape,
+        predicate: p.slots.predicate,
+        role: p.slots.role,
+        scope: p.slots.scope,
+      })),
+      // A constraint is a precondition on the SUCCESSOR state; it rides the
+      // record's precondition list so a bridged family stays complete.
+      ...constraints.map((c) => ({
+        pred: "taught:world-constraint",
+        left: c.slots.left,
+        right: c.slots.right,
+        guard: c.slots.guard,
+      })),
+    ],
     effects: {
       add: effects.map((e) => ({
         pred: "taught:world-effect",

package/src/syllogise.mjs

@@ -694,6 +694,7 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
   const trustByTriple = new Map();
   for (const r of rows) trustByTriple.set(`${r.subject}${SEP}${r.predicate}${SEP}${r.object}`, r.trust);
   const premiseTrust = (s, p, o) => trustByTriple.get(`${s}${SEP}${p}${SEP}${o}`);
+  const hasTriple = (s, p, o) => trustByTriple.has(`${s}${SEP}${p}${SEP}${o}`);
   const numericOnly = (arr) => arr.filter((t) => typeof t === "number");
 
   const scmDerived = deriveSubClassClosure(subClassEdges, { depth, budget, focus: normalizedFocus });
@@ -732,11 +733,12 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
     ...scmDerived.map((d) => ({
       subject: d.subject, predicate: SUBCLASS_PREDICATE, object: d.object,
       provenance: ENTAILED_PROVENANCE,
-      // Persisted justification, scm-sco only: the two premise fact ids this
-      // conclusion rode (a⊑b, b⊑c) — content-addressed ids work even when a
-      // premise is itself an entailment this same pass just derived. Read
-      // back by retractSubClassOf (below) to find every entailment a
-      // retracted premise could have supported.
+      // Persisted justification: the premise fact ids this conclusion rode
+      // (a⊑b, b⊑c) — content-addressed ids work even when a premise is
+      // itself an entailment this same pass just derived. Read back by
+      // retractSubClassOf (below) to find every entailment a retracted
+      // premise could have supported. All five rules persist one, each
+      // citing its own premise shape.
       justification: [
         factIdForTriple(d.subject, SUBCLASS_PREDICATE, d.via),
         factIdForTriple(d.via, SUBCLASS_PREDICATE, d.object),
@@ -745,15 +747,24 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
     ...caxDerived.map((d) => ({
       subject: d.subject, predicate: TYPE_PREDICATE, object: d.object,
       provenance: ENTAILED_TYPE_PROVENANCE,
+      // The ⊑ premise is cited as the DIRECT via⊑object edge even when the
+      // taught chain is multi-hop: scm-sco materializes that edge (this same
+      // pass or an earlier one), and retraction re-VERIFIES every candidate
+      // anyway, so a citation left dangling by budget truncation is inert.
+      justification: [
+        factIdForTriple(d.subject, TYPE_PREDICATE, d.via),
+        factIdForTriple(d.via, SUBCLASS_PREDICATE, d.object),
+      ],
     })),
     ...dwDerived.map((d) => {
       // disjointWith is symmetric, taught as ONE direction — the premise row
-      // could be stored either (viaClass, disjointWith, object) or its mirror.
-      const dwTrust = premiseTrust(d.viaClass, DISJOINT_PREDICATE, d.object)
-        ?? premiseTrust(d.object, DISJOINT_PREDICATE, d.viaClass);
+      // could be stored either (viaClass, disjointWith, object) or its
+      // mirror; resolve which, so the justification cites a real stored id.
+      const dwStoredForward = hasTriple(d.viaClass, DISJOINT_PREDICATE, d.object);
+      const [dwS, dwO] = dwStoredForward ? [d.viaClass, d.object] : [d.object, d.viaClass];
       const premiseTrusts = numericOnly([
         premiseTrust(d.subject, TYPE_PREDICATE, d.viaType),
-        dwTrust,
+        premiseTrust(dwS, DISJOINT_PREDICATE, dwO),
         // the ⊑-lift premise only exists when this IS a lift (viaClass !==
         // viaType) — a direct hit has no extra subClassOf premise to price in.
         ...(d.viaClass !== d.viaType ? [premiseTrust(d.viaType, SUBCLASS_PREDICATE, d.viaClass)] : []),
@@ -761,6 +772,11 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
       return {
         subject: d.subject, predicate: DISJOINT_PREDICATE, object: d.object,
         provenance: ENTAILED_DISJOINT_PROVENANCE,
+        justification: [
+          factIdForTriple(d.subject, TYPE_PREDICATE, d.viaType),
+          factIdForTriple(dwS, DISJOINT_PREDICATE, dwO),
+          ...(d.viaClass !== d.viaType ? [factIdForTriple(d.viaType, SUBCLASS_PREDICATE, d.viaClass)] : []),
+        ],
         ...(premiseTrusts.length ? { premiseTrusts, ruleConfidence: CAX_DW_RULE_CONFIDENCE } : {}),
       };
     }),
@@ -777,6 +793,13 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
       return {
         subject: d.subject, predicate: TYPE_PREDICATE, object: d.object,
         provenance: ENTAILED_SVF1_PROVENANCE,
+        justification: [
+          factIdForTriple(d.subject, d.viaProperty, d.viaValue),
+          factIdForTriple(d.viaValue, TYPE_PREDICATE, d.viaType),
+          factIdForTriple(d.object, ON_PROPERTY_PREDICATE, d.viaPropertyKey),
+          factIdForTriple(d.object, SOME_VALUES_FROM_PREDICATE, d.viaTarget),
+          ...(d.viaType !== d.viaTarget ? [factIdForTriple(d.viaType, SUBCLASS_PREDICATE, d.viaTarget)] : []),
+        ],
         // same sub-1 discount as cax-dw, same reason (see CAX_DW_RULE_CONFIDENCE).
         ...(premiseTrusts.length ? { premiseTrusts, ruleConfidence: CLS_SVF1_RULE_CONFIDENCE } : {}),
       };
@@ -794,6 +817,13 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
       return {
         subject: d.subject, predicate: SUBCLASS_PREDICATE, object: d.object,
         provenance: ENTAILED_SCM_SVF_PROVENANCE,
+        justification: [
+          ...(r1 ? [factIdForTriple(d.subject, ON_PROPERTY_PREDICATE, r1.property)] : []),
+          factIdForTriple(d.subject, SOME_VALUES_FROM_PREDICATE, d.viaY1),
+          ...(r2 ? [factIdForTriple(d.object, ON_PROPERTY_PREDICATE, r2.property)] : []),
+          factIdForTriple(d.object, SOME_VALUES_FROM_PREDICATE, d.viaY2),
+          factIdForTriple(d.viaY1, SUBCLASS_PREDICATE, d.viaY2),
+        ],
         // same sub-1 discount as cax-dw/cls-svf1, same reason (see CAX_DW_RULE_CONFIDENCE).
         ...(premiseTrusts.length ? { premiseTrusts, ruleConfidence: SCM_SVF_RULE_CONFIDENCE } : {}),
       };
@@ -838,21 +868,112 @@ function isPurelyEntailed(provenance) {
   return tags.length > 0 && tags.every((t) => t.startsWith("entailed:"));
 }
 
+/** Builds the per-round VERIFY oracle for retraction: given ONLY the
+ *  surviving fact rows, returns `stillDerivable(row)` — true when the row's
+ *  (s,p,o) conclusion is re-derivable from survivors by the rule family that
+ *  owns its predicate (scm-sco/scm-svf1 for subClassOf, cax-sco/cls-svf1 for
+ *  rdf:type, cax-dw for disjointWith). One shared ancestor closure plus small
+ *  indexes per round, joining exactly what each derive kernel joins. Pure,
+ *  no I/O. */
+function buildSurvivorDerivabilityCheck(rows) {
+  const subClassEdges = [];
+  const typesOf = new Map();          // x -> Set(surviving direct type classes)
+  const disjointOf = new Map();       // term -> Set(disjoint partners), symmetric
+  const onPropertyOf = new Map();     // restriction -> owl:onProperty's object
+  const someValuesFromOf = new Map(); // restriction -> owl:someValuesFrom's object
+  const propertyEdgesOf = new Map();  // x -> [[normalized predicate, y], …]
+  for (const r of rows) {
+    const pLower = String(r.predicate || "").trim().toLowerCase();
+    if (isSubClassOf(r.predicate)) subClassEdges.push([r.subject, r.object]);
+    else if (isType(r.predicate)) {
+      if (!typesOf.has(r.subject)) typesOf.set(r.subject, new Set());
+      typesOf.get(r.subject).add(r.object);
+    } else if (isDisjoint(r.predicate)) {
+      if (!disjointOf.has(r.subject)) disjointOf.set(r.subject, new Set());
+      disjointOf.get(r.subject).add(r.object);
+      if (!disjointOf.has(r.object)) disjointOf.set(r.object, new Set());
+      disjointOf.get(r.object).add(r.subject);
+    } else if (isOnProperty(r.predicate)) onPropertyOf.set(r.subject, r.object);
+    else if (isSomeValuesFrom(r.predicate)) someValuesFromOf.set(r.subject, r.object);
+    else if (!RESERVED_PREDICATES.has(pLower)) {
+      if (!propertyEdgesOf.has(r.subject)) propertyEdgesOf.set(r.subject, []);
+      propertyEdgesOf.get(r.subject).push([normFactTerm(r.predicate), r.object]);
+    }
+  }
+  const ancestorsOf = buildAncestorCloser(subClassEdges);
+  const reaches = (a, b) => a !== b && ancestorsOf(a).has(b);
+  const restrictionOf = (node) => {
+    const property = onPropertyOf.get(node);
+    const target = someValuesFromOf.get(node);
+    return property && target ? { property: normFactTerm(property), target } : null;
+  };
+
+  return (row) => {
+    if (isSubClassOf(row.predicate)) {
+      // scm-sco: some surviving ⊑-path still connects subject to object.
+      if (reaches(row.subject, row.object)) return true;
+      // scm-svf1: both ends still declared restrictions over the SAME
+      // property, with strictly ⊑-related fillers (kernel-faithful).
+      const r1 = restrictionOf(row.subject);
+      const r2 = restrictionOf(row.object);
+      return Boolean(r1 && r2 && r1.property === r2.property && reaches(r1.target, r2.target));
+    }
+    if (isType(row.predicate)) {
+      // cax-sco: a surviving direct type whose ⊑-closure reaches the class.
+      for (const c of typesOf.get(row.subject) || []) {
+        if (reaches(c, row.object)) return true;
+      }
+      // cls-svf1: the class is a still-declared restriction node — a
+      // surviving property edge whose value's type (⊑-lifted) satisfies it.
+      const rec = restrictionOf(row.object);
+      if (rec) {
+        for (const [pKey, y] of propertyEdgesOf.get(row.subject) || []) {
+          if (pKey !== rec.property) continue;
+          for (const c of typesOf.get(y) || []) {
+            if (c === rec.target || reaches(c, rec.target)) return true;
+          }
+        }
+      }
+      return false;
+    }
+    if (isDisjoint(row.predicate)) {
+      // cax-dw: a surviving type whose ⊑-closure meets a surviving
+      // disjointWith partner equal to the conclusion's object.
+      for (const c of typesOf.get(row.subject) || []) {
+        for (const d of [c, ...ancestorsOf(c)]) {
+          if (disjointOf.get(d)?.has(row.object)) return true;
+        }
+      }
+      return false;
+    }
+    // An entailed predicate no rule family here owns: nothing can re-check
+    // it, so it is never removed on a stale citation alone.
+    return true;
+  };
+}
+
 /**
- * A scoped retraction slice: JTMS-style dependency-directed removal, for
- * scm-sco ONLY. Retracting `subject ⊑ object` removes the fact, then cascades
- * to any purely-entailed scm-sco fact whose persisted justification cites a
- * removed id — but each candidate is VERIFIED (re-derivable over the
- * surviving subClassOf edge set, not just "cited a removed id") before it is
+ * A scoped retraction slice: JTMS-style dependency-directed removal.
+ * Retracting `subject ⊑ object` removes the fact, then cascades to any
+ * purely-entailed fact — across all five rules' conclusions — whose persisted
+ * justification cites a removed id. Each candidate is VERIFIED (re-derivable
+ * from the surviving facts, not just "cited a removed id") before it is
  * actually removed, since a fact can have a second, independent derivation
  * path (a⊑b⊑d AND a⊑c⊑d both license a⊑d) that a bare delete-by-justification
  * walk would wrongly discard. Repeats in rounds — a removed mid-chain link
  * can ripple — bounded by `budget` (max facts examined+removed) and `depth`
  * (max cascade rounds).
  *
- * Scope limit: only scm-sco persists a justification today, so a
- * type/disjointWith/someValuesFrom conclusion that also went stale is not
- * cascaded here (mechanical to extend, not attempted in this slice).
+ * The entry point stays subClassOf-rooted because chat's recognized
+ * retraction phrasings ("X is not a Y", "forget that X is a kind of Y",
+ * chat.mjs's teach lane) retract subClassOf facts; the cascade itself follows
+ * justifications into every rule's conclusions (transitive ⊑, propagated
+ * types, disjointness violations, restriction membership and subsumption).
+ *
+ * A survivor keeps its stale, still-single justification as-is; a later
+ * retraction of its OTHER supporting path therefore won't re-examine it.
+ * Re-grounding survivors — or tracking every alternate justification set —
+ * is the ATMS horizon (PLAN_SYLLOGIST.md §3), not this bounded slice.
  *
  * Returns { retracted, count, budget, depth, truncated, found } — `found` is
  * false when `subject ⊑ object` was never a stored fact.
@@ -866,43 +987,38 @@ export async function retractSubClassOf(repoDir, subject, object, { budget = 50,
   const byId = new Map(rows.map((r) => [r.id, r]));
   if (!byId.has(targetId)) return { retracted: [], count: 0, budget, depth, truncated: false, found: false };
 
-  // The FULL current subClassOf edge set (stated + every prior entailment) —
-  // the working graph this function's VERIFY step walks each round; a
-  // removed id's own edge is excluded from that round's walk onward.
-  const scRows = rows.filter((r) => isSubClassOf(r.predicate));
-  const edgeOf = new Map(scRows.map((r) => [r.id, [r.subject, r.object]]));
-  // Only a purely-entailed scm-sco fact ever carries a walkable justification.
-  const entailedScRows = scRows.filter((r) => r.justification.length && isPurelyEntailed(r.provenance));
+  // Only a purely-entailed fact ever carries a walkable justification —
+  // a fact later independently taught is never a cascade candidate at all.
+  const entailedRows = rows.filter((r) => r.justification.length && isPurelyEntailed(r.provenance));
 
   const removed = new Set([targetId]);
   const order = [targetId]; // deterministic report order: target first, then removal order
   let truncated = false;
   let round = 0;
   for (; round < depth; round += 1) {
-    const candidates = entailedScRows
+    const candidates = entailedRows
       .filter((r) => !removed.has(r.id) && r.justification.some((j) => removed.has(j)))
-      .sort((a, b) => a.subject.localeCompare(b.subject) || a.object.localeCompare(b.object));
+      .sort((a, b) => a.subject.localeCompare(b.subject) || a.predicate.localeCompare(b.predicate) || a.object.localeCompare(b.object));
     if (!candidates.length) break; // fixpoint — nothing left to (re-)check
 
-    // The surviving edge set for THIS round's verify walk excludes every
-    // candidate's own edge too, not just `removed` — otherwise a candidate
+    // The surviving fact set for THIS round's verify walk excludes every
+    // candidate's own row too, not just `removed` — otherwise a candidate
     // could trivially "reach itself" through its own not-yet-deleted edge, or
     // lean on a sibling candidate standing on the same broken premise.
     const candidateIds = new Set(candidates.map((c) => c.id));
-    const survivingEdges = [...edgeOf.entries()]
-      .filter(([id]) => !removed.has(id) && !candidateIds.has(id))
-      .map(([, e]) => e);
-    const ancestorsOf = buildAncestorCloser(survivingEdges);
+    const stillDerivable = buildSurvivorDerivabilityCheck(
+      rows.filter((r) => !removed.has(r.id) && !candidateIds.has(r.id)),
+    );
 
     let progressed = false;
     let hitBudget = false;
     for (const c of candidates) {
       if (removed.size >= budget) { hitBudget = true; break; }
-      // does subject⊑object still hold WITHOUT the retracted premise, via ANY
-      // surviving path (not just the one this fact was originally derived
-      // through)? A survivor keeps its (now possibly re-groundable, still
-      // TRUE) fact and is never re-examined again this call.
-      if (ancestorsOf(c.subject).has(c.object)) continue; // a second, independent path still supports it — keep
+      // does the conclusion still hold WITHOUT the retracted premise, via ANY
+      // surviving derivation (not just the one this fact was originally
+      // derived through)? A survivor keeps its (now possibly re-groundable,
+      // still TRUE) fact and is never re-examined again this call.
+      if (stillDerivable(c)) continue; // a second, independent derivation still supports it — keep
       removed.add(c.id);
       order.push(c.id);
       progressed = true;
@@ -913,7 +1029,7 @@ export async function retractSubClassOf(repoDir, subject, object, { budget = 50,
   if (!truncated && round >= depth) {
     // depth exhausted, not a natural fixpoint — honestly flag it if a
     // pending candidate would still have been checked next round.
-    truncated = entailedScRows.some((r) => !removed.has(r.id) && r.justification.some((j) => removed.has(j)));
+    truncated = entailedRows.some((r) => !removed.has(r.id) && r.justification.some((j) => removed.has(j)));
   }
 
   const { removed: actuallyRemoved } = await removeFacts(repoDir, order);

package/src/viz-theme.mjs

@@ -1,6 +1,7 @@
-// viz-theme.mjs — the shared visual tokens for tmct's generated HTML pages
-// (the ledger explorer and the plan player draw from this one table; the
-// values are PLAN_VIZ_LEDGER.md's reference token table).
+// viz-theme.mjs — the shared assets for tmct's generated HTML pages
+// (the ledger explorer and the plan player): the visual token table
+// (PLAN_VIZ_LEDGER.md's reference values) plus the escaping helpers every
+// page builder needs.
 //
 // Trust tiers are precomputed rgba() values per provenance color so pages
 // render identically on browsers without color-mix() support.
@@ -8,6 +9,21 @@
 export const SERIF_STACK = `"Charter", "Bitstream Charter", Georgia, "Times New Roman", serif`;
 export const MONO_STACK = `ui-monospace, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace`;
 
+/** Escape untrusted text for safe placement inside HTML content/attributes. */
+export function escapeHtml(s) {
+  return String(s ?? "").replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+}
+
+/** JSON-embed page data into a `<script>` tag safely — escape `</` so a
+ *  label/id containing "</script>" can't break out of the tag, and escape
+ *  U+2028/U+2029 (valid in JSON strings, invalid unescaped in JS source). */
+export function embedJson(value) {
+  return JSON.stringify(value)
+    .replace(/</g, "\\u003c")
+    .replace(/\u2028/g, "\\u2028")
+    .replace(/\u2029/g, "\\u2029");
+}
+
 /** hex "#RRGGBB" -> "rgba(r, g, b, a)" */
 function rgba(hex, alpha) {
   const n = parseInt(hex.slice(1), 16);

package/src/ask-browser-entry.mjs

@@ -1,19 +0,0 @@
-// ask-browser-entry.mjs — the esbuild entry for `tmct viz`'s embedded "Ask the
-// graph" chat panel: a real NL chat running client-side against the embedded
-// graph, via tmct's own JS engine (esbuild + a Node-builtin stub plugin
-// bundles tmct's real ask() into a single browser IIFE).
-//
-import { ask, parseQuery } from "./ask.mjs";
-import {
-  parseEntities, spiralExpand, mostRecentIndividual, derivedUpdatedAt, MEMORY_SPIRAL_EXPAND_KINDS,
-  MEMORY_FACT_LINK_KINDS, buildVizNodesAndEdges, deriveFactTermGraph, pickLegendDimension, legendValueFor,
-  edgeKindsFor, collapseToTopN,
-} from "./codegraph.mjs";
-
-// Exported so the viewer page's client-side recentre/edge-kind-toggle/
-// dimension-switcher reuses the same computation as the CLI, not a second copy.
-globalThis.tmctViz = {
-  ask, parseQuery, parseEntities, spiralExpand, mostRecentIndividual, derivedUpdatedAt,
-  MEMORY_SPIRAL_EXPAND_KINDS, MEMORY_FACT_LINK_KINDS, buildVizNodesAndEdges,
-  deriveFactTermGraph, pickLegendDimension, legendValueFor, edgeKindsFor, collapseToTopN,
-};