@polycode-projects/the-mechanical-code-talker 1.5.4 → 1.8.3

package/src/syllogise.mjs

@@ -11,7 +11,7 @@
 // INF-A2) without that being "the batch pass on the hot path" — nothing is
 // written to memory unless `syllogise()` itself is called.
 //
-// Deliberately narrow (the plan's kill-criterion discipline): FOUR rules —
+// Deliberately narrow (the plan's kill-criterion discipline): FIVE rules —
 //   - scm-sco: rdfs:subClassOf transitivity — (a ⊑ b), (b ⊑ c) ⊨ (a ⊑ c).
 //     The simplest OWL 2 RL rule, exactly what the ACE grammar's pattern 1
 //     emits (`deriveSubClassClosure`).
@@ -39,8 +39,20 @@
 //     then cax-sco across `⊑ N3`, three more rules deep. That composition is
 //     a documented follow-up (PLAN_INFERENCE_TESTING.md §4 stage 4's
 //     remaining scm-svf row), not attempted here (`deriveSomeValuesFromApplication`).
+//   - scm-svf1: someValuesFrom restriction SUBSUMPTION — two INDEPENDENTLY
+//     declared restrictions over the SAME property, whose filler classes are
+//     ⊑-related, entail the restriction NODES are themselves ⊑-related (W3C
+//     OWL 2 RL Table 9's scm-svf1 — confirmed, against the real downloaded
+//     spec, a DISTINCT rule from scm-svf2, which needs `rdfs:subPropertyOf`
+//     instead; tmct's ACE grammar has no way to teach property subsumption at
+//     all, so scm-svf2 is out of scope for a real reason, not laziness). Joined
+//     the batch pass in a follow-up build (this session): originally deferred
+//     (INFBENCH's two drive points never touched the batch pass, so nothing
+//     was lost by deferring), closed once a positive INFBENCH fixture case
+//     (`c1ScmSvfApply`) existed to measure it against
+//     (`deriveSomeValuesFromSubsumption`).
 //
-// The whole safety story is four guards, all mechanical, shared by all four rules:
+// The whole safety story is four guards, all mechanical, shared by all five rules:
 //   - BUDGET — at most `budget` NEW derivations per pass (default 50), and at
 //     most `depth` fixpoint rounds (scm-sco only — cax-sco/cax-dw need no
 //     fixpoint, see their own doc comments). The pass stops at whichever bites
@@ -54,17 +66,40 @@
 //     content key — the same novelty test appendFact's content-hash id enforces).
 //
 // Every derived fact is written via appendFacts with `entailed:subClassOf`
-// (scm-sco), `entailed:type` (cax-sco), `entailed:disjointWith` (cax-dw), or
-// `entailed:someValuesFrom` (cls-svf1) provenance (a first-class entailed
-// Source, trust prior 0.3 in memory/trust.mjs) so it is LOW trust, NEVER
-// outranks a stated fact, and is fully RETRACTABLE by provenance when the
-// source graph moves. cax-dw's and cls-svf1's conclusions additionally ride
-// trust.mjs's entailed hook when their OWN premises are resolvable in the
-// pre-pass snapshot — premise-derived (`min(premiseTrusts) × ruleConfidence`),
-// still always strictly below its weakest premise (see syllogise()'s own doc
+// (scm-sco), `entailed:type` (cax-sco), `entailed:disjointWith` (cax-dw),
+// `entailed:someValuesFrom` (cls-svf1), or `entailed:someValuesFromSubsumption`
+// (scm-svf1) provenance (a first-class entailed Source, trust prior 0.3 in
+// memory/trust.mjs) so it is LOW trust, NEVER outranks a stated fact, and is
+// fully RETRACTABLE by provenance when the source graph moves. cax-dw's,
+// cls-svf1's, and scm-svf1's conclusions additionally ride trust.mjs's
+// entailed hook when their OWN premises are resolvable in the pre-pass
+// snapshot — premise-derived (`min(premiseTrusts) × ruleConfidence`), still
+// always strictly below its weakest premise (see syllogise()'s own doc
 // comment) — rather than the bare entailed floor; scm-sco/cax-sco do not
 // (yet) engage that hook — see syllogise()'s doc comment for why that
 // specific extension is non-trivial.
+//
+// TWO MORE capabilities live below (PLAN_INFERENCE_TESTING.md §4 stage 4's
+// remainder, INF-C1), both LIVE-CHASE ONLY — never added to `syllogise()`'s own
+// materializing batch pass (documented as a deliberate design choice at each
+// export's own doc comment, not an oversight — see each one for the specific
+// reason: neither is an enumerable "derive every new fact of this shape"
+// closure the way the five rules above are):
+//   - cardinality monotonicity: a class's OWN declared exactly/min cardinality
+//     restriction (n) proves "at least m" for any QUERIED m ≤ n. Confirmed
+//     OUTSIDE OWL 2 RL's own decidable profile (the spec's own `cls-*` rule
+//     table has no rule comparing exactly/min/max cardinalities to each
+//     other, and the profile's syntactic restriction limits cardinality
+//     expressions to 0 or 1 only) — genuinely LIVE-CHASE ONLY, never a
+//     candidate for the batch pass at all, not merely deferred
+//     (`proveCardinalityAtLeast`).
+//   - cax-maxc0: max-cardinality-0 as encoded negation. Grounded in W3C OWL 2
+//     RL's real `cls-maxc1` rule (an ABox contradiction: asserting a specific
+//     individual has a value for a max-0-restricted property is
+//     inconsistent) via a one-step universal generalization — since ANY
+//     witnessed individual would be a contradiction, no true witness can
+//     exist, so a general "no" is provable without needing one
+//     (`proveMaxCardinalityZeroDenial`).
 
 import { loadMemory, appendFacts, readFactRows, normFactTerm } from "./memory/core.mjs";
 
@@ -129,6 +164,7 @@ const isType = (p) => String(p || "").trim().toLowerCase() === "rdf:type";
 const isDisjoint = (p) => String(p || "").trim().toLowerCase() === "owl:disjointwith";
 const isOnProperty = (p) => String(p || "").trim().toLowerCase() === "owl:onproperty";
 const isSomeValuesFrom = (p) => String(p || "").trim().toLowerCase() === "owl:somevaluesfrom";
+const isOnClass = (p) => String(p || "").trim().toLowerCase() === "owl:onclass";
 /** The four structural OWL predicates cls-svf1 itself consumes/emits, plus
  *  the two subClassOf/type/disjointWith predicates the other three rules
  *  own — excluded from `syllogise()`'s generic "property edge" scan so a
@@ -138,6 +174,30 @@ const RESERVED_PREDICATES = new Set([
   "rdfs:subclassof", "rdf:type", "owl:disjointwith", "owl:onproperty", "owl:somevaluesfrom", "owl:intersectionof",
 ]);
 
+/**
+ * PURE `min(premiseTrusts) × ruleConfidence` — the entailed hook's own core
+ * arithmetic (memory/trust.mjs `computeTrust`), exposed here so a caller that
+ * has NO Fact/appendFacts call to delegate to (a LIVE, read-only chat proof
+ * chase — chat.mjs's scm-svf1/cardinality-monotonicity/cax-maxc0 call sites)
+ * can still compute the SAME premise-derived figure `computeTrust` would land
+ * on for a materialized fact (recency sits at ~1.0 for a freshly-derived
+ * conclusion, so the two agree). `syllogise()`'s own `appendFacts` mapping
+ * does NOT call this — it hands `premiseTrusts`/`ruleConfidence` straight to
+ * `appendFacts` → `computeTrust`, which ALSO applies the recency nudge; this
+ * helper is for the read-only case that has no Fact to nudge. Returns `null`
+ * when no numeric premise trust was supplied (nothing to compute from — never
+ * a magic default), else clamped to [0,1]. Pure, no I/O.
+ */
+export function entailedTrustFrom(premiseTrusts, ruleConfidence = 1) {
+  const nums = (Array.isArray(premiseTrusts) ? premiseTrusts : []).filter((t) => typeof t === "number");
+  if (!nums.length) return null;
+  const clamped = Math.max(0, Math.min(1, Math.min(...nums) * ruleConfidence));
+  // rounded to 6dp — mirrors memory/trust.mjs's own `round(n, 6)` convention,
+  // so a live-chase figure reads identically to what computeTrust would have
+  // stored had this conclusion been persisted.
+  return Number(clamped.toFixed(6));
+}
+
 /** Normalize a focus hint (Set|array of terms) into the same normalized-term
  *  space stored facts live in, or null for "no focus → whole graph". */
 function normalizeFocus(focus) {
@@ -482,6 +542,272 @@ export function deriveSomeValuesFromApplication(propertyEdges, typeEdges, subCla
   return derived;
 }
 
+// ---- shared cardinality-restriction reconstruction (pattern-5, parseCardinality) ----
+// "every N1 has exactly n N2s" already stores `{N1, rdfs:subClassOf, r}` as a
+// plain row (`r = tmct:exactly-N-n2`) plus the restriction node r's own
+// scaffolding: `r owl:onProperty tmct:has`, `r <kind> "n"` (kind one of
+// owl:cardinality/owl:minCardinality/owl:maxCardinality), `r owl:onClass N2`
+// (`src/grammar/ace.mjs`'s `parseCardinality`, ~lines 234-257) — the SAME
+// per-fact storage discipline `deriveSomeValuesFromApplication`'s
+// `restrictionEdges` already reconstructs for someValuesFrom restrictions,
+// applied to pattern 5's shape instead.
+const HAS_PROPERTY_KEY = "has"; // the fixed synthetic marker property parseCardinality always mints (ace.mjs ~line 252) — never a real taught verb, so it doubles as this reconstruction's own defensive filter (see buildCardinalityRestrictions below): a someValuesFrom restriction's onProperty is always a REAL taught verb, never this literal marker.
+const CARDINALITY_KIND_OF = { "owl:cardinality": "exactly", "owl:mincardinality": "min", "owl:maxcardinality": "max" };
+export const ON_CLASS_PREDICATE = "owl:onClass";
+
+/** Reconstructs pattern-5 cardinality restriction records from raw stored
+ *  rows touching a restriction node — same reconstruction discipline
+ *  `deriveSomeValuesFromApplication` already uses for someValuesFrom
+ *  restrictions, applied to pattern 5's shape instead. `rows` is the same
+ *  `[{subject,predicate,object}, …]` shape `readFactRows`/`syllogise()`'s own
+ *  `rows` param takes (raw predicate casing, already-normalized subject/
+ *  object) — a caller may hand it EVERY stored row (this function ignores
+ *  anything that isn't one of the four predicates it cares about) or a
+ *  pre-filtered subset. A restriction is only admitted when its OWN
+ *  `owl:onProperty` row resolves to `HAS_PROPERTY_KEY` — the defensive belt
+ *  that keeps a someValuesFrom restriction's scaffolding (which ALSO uses
+ *  `owl:onProperty`, just with a real verb) from ever being mistaken for a
+ *  cardinality restriction when both kinds' rows are scanned together (e.g.
+ *  chat.mjs's live wiring, which reads the whole taught-fact set at once).
+ *  Returns `[{ restriction, kind, n, onClass }, …]`, deterministic order
+ *  (sorted by restriction id). Pure, no I/O. */
+export function buildCardinalityRestrictions(rows) {
+  const onPropertyOf = new Map(); // restriction -> owl:onProperty's object
+  const kindOf = new Map();       // restriction -> { kind, n }
+  const onClassOf = new Map();    // restriction -> owl:onClass's object
+  for (const r of rows || []) {
+    if (!r || !r.subject || !r.predicate) continue;
+    if (isOnProperty(r.predicate)) onPropertyOf.set(r.subject, r.object);
+    else if (isOnClass(r.predicate)) onClassOf.set(r.subject, r.object);
+    else {
+      const kind = CARDINALITY_KIND_OF[String(r.predicate).trim().toLowerCase()];
+      if (!kind) continue;
+      const n = Number(r.object);
+      if (Number.isFinite(n)) kindOf.set(r.subject, { kind, n });
+    }
+  }
+  const restrictions = [];
+  for (const [restriction, { kind, n }] of kindOf) {
+    if (onPropertyOf.get(restriction) !== HAS_PROPERTY_KEY) continue; // not a cardinality restriction's own onProperty row — skip (the defensive belt, see doc comment)
+    const onClass = onClassOf.get(restriction);
+    if (!onClass) continue;
+    restrictions.push({ restriction, kind, n, onClass });
+  }
+  restrictions.sort((a, b) => a.restriction.localeCompare(b.restriction));
+  return restrictions;
+}
+
+// ---- scm-svf1: someValuesFrom restriction subsumption (W3C OWL 2 RL Table 9,
+// scm-svf1 — confirmed distinct from scm-svf2, which needs property
+// subsumption tmct can't teach yet, see this file's header comment) ----
+export const SCM_SVF_RULE = "someValuesFromSubsumption";
+export const ENTAILED_SCM_SVF_PROVENANCE = `entailed:${SCM_SVF_RULE}`;
+/** trust.mjs's entailed hook's rule-confidence for scm-svf1 — the same sub-1
+ *  discount cax-dw/cls-svf1 use and for the identical reason (see
+ *  CAX_DW_RULE_CONFIDENCE's own comment): keeps a premise-derived conclusion
+ *  STRICTLY below its weakest premise's trust, every time. Wired into
+ *  `syllogise()`'s own materializing pass (below) — scm-svf1 joined the batch
+ *  pass in a follow-up build, see this file's header comment. */
+export const SCM_SVF_RULE_CONFIDENCE = 0.95;
+
+/**
+ * PURE scm-svf1: c1 someValuesFrom y1, c1 onProperty p, c2 someValuesFrom y2,
+ * c2 onProperty p, y1 ⊑ y2 (lifted through y1's FULL ⊑-ancestor closure, same
+ * lift discipline as cax-dw/cls-svf1) |= c1 ⊑ c2 — a schema-level fact about
+ * the restriction NODES themselves, TWO independently-declared restrictions
+ * being required to compare (unlike cardinality monotonicity/cax-maxc0 below,
+ * each sufficient from a SINGLE declared restriction). `restrictionEdges` is
+ * the SAME `[{ restriction, property, target }, …]` shape
+ * `deriveSomeValuesFromApplication` already takes (`property`/`target`
+ * already normFactTerm-normalized); `subClassEdges` is the ordinary
+ * `[[a,b], …]` shape every other rule in this file takes, a FIXED input never
+ * mutated by this function (so no fixpoint rounds are needed, same reasoning
+ * as `deriveTypePropagation`'s own doc comment). Restrictions are grouped by
+ * their (normalized) property — only restrictions sharing the SAME property
+ * are ever compared, matching the rule's own premise shape (`c1 onProperty p`,
+ * `c2 onProperty p`, the SAME p).
+ *
+ * Deliberately LIVE-CHASE ONLY for this build (see this file's header
+ * comment): never added to `syllogise()`'s materializing batch pass.
+ *
+ * Returns ONLY new `{ subject, object, viaY1, viaY2 }` conclusions (`subject`/
+ * `object` are the two restriction node ids, `viaY1`/`viaY2` the specific
+ * filler classes whose ⊑-relation licensed it), bounded by `budget`,
+ * focus-filtered, tautology- and dedup-screened, deterministic order. No I/O.
+ */
+export function deriveSomeValuesFromSubsumption(restrictionEdges, subClassEdges, { budget = 50, focus = null } = {}) {
+  const ancestorsOf = buildAncestorCloser(subClassEdges);
+
+  const byProperty = new Map(); // normalized property -> [{ restriction, target }]
+  for (const r of restrictionEdges || []) {
+    if (!r || !r.restriction || !r.property || !r.target) continue;
+    const pKey = normFactTerm(r.property);
+    if (!byProperty.has(pKey)) byProperty.set(pKey, []);
+    byProperty.get(pKey).push({ restriction: r.restriction, target: r.target });
+  }
+
+  const present = new Set(); // "c1\0c2" for a subClassOf edge already known between two restriction nodes (dedup/novelty screen, same discipline as every other rule here)
+  for (const [a, b] of subClassEdges || []) if (a && b) present.add(`${a}${SEP}${b}`);
+
+  const focusSet = focus instanceof Set ? (focus.size ? focus : null) : normalizeFocus(focus);
+  const inFocus = (c1, c2) => !focusSet || focusSet.has(c1) || focusSet.has(c2);
+
+  const candidates = [];
+  for (const [, group] of byProperty) {
+    if (group.length < 2) continue; // need TWO independently-declared restrictions to compare
+    for (const r1 of group) {
+      for (const r2 of group) {
+        if (r1.restriction === r2.restriction) continue;    // tautology screen
+        if (r1.target === r2.target) continue;              // same filler, same node by construction — no new fact
+        if (!ancestorsOf(r1.target).has(r2.target)) continue; // y1 must be ⊑ y2 (the FULL ⊑-lift)
+        const key = `${r1.restriction}${SEP}${r2.restriction}`;
+        if (present.has(key)) continue;                      // dedup / novelty screen
+        if (!inFocus(r1.restriction, r2.restriction)) continue; // focus-connection screen
+        candidates.push([r1.restriction, r2.restriction, r1.target, r2.target, key]);
+      }
+    }
+  }
+  candidates.sort((a, b) => a[0].localeCompare(b[0]) || a[1].localeCompare(b[1]));
+  const derived = [];
+  const derivedKeys = new Set();
+  for (const [c1, c2, y1, y2, key] of candidates) {
+    if (derivedKeys.has(key)) continue;
+    if (derived.length >= budget) break;
+    derivedKeys.add(key);
+    derived.push({ subject: c1, object: c2, viaY1: y1, viaY2: y2 });
+  }
+  return derived;
+}
+
+// ---- shared machinery for cardinality monotonicity / cax-maxc0: both are
+// single-premise-sufficient (no SECOND independently-taught restriction
+// needed, unlike scm-svf1 above) — a class's OWN declared cardinality
+// restriction, walked through its FULL ⊑-ancestor closure (same lift
+// discipline as every other rule in this file). ----
+
+/** Shared bounded proof search for `proveCardinalityAtLeast`/
+ *  `proveMaxCardinalityZeroDenial`: walks `subject`'s OWN ⊑-ancestor closure
+ *  (itself first, then ancestors — the FULL lift, same discipline as cax-dw/
+ *  cls-svf1) looking for a class with a DIRECTLY declared cardinality
+ *  restriction satisfying `matches(record)`. `cardinalityRestrictionEdges` is
+ *  `buildCardinalityRestrictions`'s own output shape. Returns the first
+ *  `{ viaClass, viaRestriction, record }` found (deterministic — the ancestor
+ *  walk's order is fixed for a given edge set) or null. `budget` bounds how
+ *  many candidate classes (subject + ancestors) are examined, a QUERY-rooted
+ *  proof search in the same spirit as `findIsaChain`'s `maxHops`, not a
+ *  batch-derivation cap. Pure, no I/O. */
+function findOwnCardinalityRestriction(subClassEdges, cardinalityRestrictionEdges, subject, matches, { budget = 20, focus = null } = {}) {
+  if (!subject) return null;
+  const ancestorsOf = buildAncestorCloser(subClassEdges);
+  const focusSet = focus instanceof Set ? (focus.size ? focus : null) : normalizeFocus(focus);
+  const inFocus = (c) => !focusSet || focusSet.has(subject) || focusSet.has(c);
+  const classToRestrictions = new Map(); // class -> Set(restriction ids DIRECTLY declared class ⊑ restriction)
+  for (const [a, b] of subClassEdges || []) {
+    if (!a || !b) continue;
+    if (!classToRestrictions.has(a)) classToRestrictions.set(a, new Set());
+    classToRestrictions.get(a).add(b);
+  }
+  const restrictionsByRid = new Map((cardinalityRestrictionEdges || []).map((r) => [r.restriction, r]));
+  let checked = 0;
+  for (const c of [subject, ...ancestorsOf(subject)]) {
+    if (checked >= budget) break;
+    checked += 1;
+    if (!inFocus(c)) continue;
+    for (const rid of classToRestrictions.get(c) || []) {
+      const rec = restrictionsByRid.get(rid);
+      if (rec && matches(rec)) return { viaClass: c, viaRestriction: rid, record: rec };
+    }
+  }
+  return null;
+}
+
+// ---- cardinality monotonicity (confirmed OUTSIDE OWL 2 RL's own decidable
+// profile, see this file's header comment) ----
+export const SCM_CARD_RULE = "cardinalityMonotonicity";
+/** trust.mjs's entailed hook's rule-confidence for cardinality monotonicity —
+ *  the same sub-1 discount every other rule on this ladder uses (see
+ *  CAX_DW_RULE_CONFIDENCE's own comment). Unlike CAX_DW_RULE_CONFIDENCE/
+ *  CLS_SVF1_RULE_CONFIDENCE/SCM_SVF_RULE_CONFIDENCE, this constant has no
+ *  `syllogise()`/`appendFacts` call site to feed: `proveCardinalityAtLeast` is
+ *  QUERY-rooted (see its own doc comment) and never produces an enumerable
+ *  Fact for the entailed hook to score — there is no `mgx:trustScore` for this
+ *  rule's answer to carry. Defined here anyway, for the same reason every
+ *  other rule-confidence constant is a named export rather than an inline
+ *  literal: chat.mjs's LIVE proof chase (the only caller) computes and
+ *  attaches a `min(premiseTrusts) × ruleConfidence` figure to its OWN answer
+ *  for auditability (`entailedTrustFrom`, below), even though today's answer
+ *  plumbing does not yet surface it past that one function's return value. */
+export const CARDINALITY_RULE_CONFIDENCE = 0.95;
+
+/**
+ * PURE: given one class `subject`'s OWN declared cardinality restriction
+ * (kind ∈ {exactly,min}, n, onClass — lifted through `subject`'s FULL
+ * ⊑-ancestor closure, so an inherited restriction counts too) and a QUERIED
+ * (`onClass`, `m`), proves "`subject` has at least `m` `onClass`" whenever
+ * `onClass` matches and `n ≥ m`. A bounded, QUERY-rooted proof (there is no
+ * fixed enumerable "new fact" to write — `m` is query-specific, a different
+ * shape than every derivation-producing rule above) — genuinely LIVE-CHASE
+ * ONLY (see this file's header comment: this is outside OWL 2 RL's own
+ * profile, and unlike scm-svf1, this one has no enumerable fact shape to ever
+ * join the batch pass — not merely deferred).
+ *
+ * Returns the witnessing `{ subject, object: onClass, m, n, kind, viaClass,
+ * viaRestriction }` or null (`viaClass` is the specific class in `subject`'s
+ * ⊑-closure the restriction was actually declared against — itself, for a
+ * direct hit, or an ancestor, for the lift). No I/O.
+ */
+export function proveCardinalityAtLeast(subClassEdges, cardinalityRestrictionEdges, subject, onClass, m, opts = {}) {
+  if (!onClass || !Number.isFinite(m)) return null;
+  const found = findOwnCardinalityRestriction(
+    subClassEdges, cardinalityRestrictionEdges, subject,
+    (rec) => rec.onClass === onClass && (rec.kind === "exactly" || rec.kind === "min") && rec.n >= m,
+    opts,
+  );
+  return found ? { subject, object: onClass, m, n: found.record.n, kind: found.record.kind, viaClass: found.viaClass, viaRestriction: found.viaRestriction } : null;
+}
+
+// ---- cax-maxc0: max-cardinality-0 as encoded negation (grounded in the real
+// W3C OWL 2 RL `cls-maxc1` ABox contradiction rule via a one-step universal
+// generalization — see this file's header comment; `cax-` prefix per this
+// ladder's "produces a provable no" naming convention, same epistemic status
+// as cax-dw) ----
+export const CAX_MAXC0_RULE = "maxCardinalityZero";
+/** trust.mjs's entailed hook's rule-confidence for cax-maxc0 — same sub-1
+ *  discount, same reason (CAX_DW_RULE_CONFIDENCE's own comment). Same caveat
+ *  as CARDINALITY_RULE_CONFIDENCE just above: `proveMaxCardinalityZeroDenial`
+ *  is QUERY-rooted and never produces an enumerable Fact either, so there is
+ *  no `mgx:trustScore` for this rule to carry — chat.mjs's LIVE proof chase
+ *  computes and attaches the `min(premiseTrusts) × ruleConfidence` figure to
+ *  its own answer for auditability (`entailedTrustFrom`, below). */
+export const CAX_MAXC0_RULE_CONFIDENCE = 0.95;
+
+/**
+ * PURE: `subject` ⊑ r (lifted through `subject`'s FULL ⊑-ancestor closure), r
+ * a maxCardinality-0 restriction (property `has`, onClass `onClass`) |= "no
+ * `subject` has a `onClass`" — the universal-generalization bridge from
+ * `cls-maxc1`'s per-individual ABox contradiction (asserting a witnessed
+ * individual would be inconsistent) to a class-level provable negative: since
+ * NO witness can exist without contradiction, the general "no" is sound.
+ * Same query-rooted, LIVE-CHASE-ONLY scope as `proveCardinalityAtLeast`
+ * (never `syllogise()`'s batch pass). NEVER infers "no" from absence — a
+ * subject with no declared max-0 restriction at all simply returns null
+ * (matching cax-dw's own discipline, `deriveDisjointViolations`'s doc
+ * comment above).
+ *
+ * Returns `{ subject, object: onClass, viaClass, viaRestriction }` or null
+ * (`viaClass` — itself, for a direct hit, or an ancestor, for the lift). No
+ * I/O.
+ */
+export function proveMaxCardinalityZeroDenial(subClassEdges, cardinalityRestrictionEdges, subject, onClass, opts = {}) {
+  if (!onClass) return null;
+  const found = findOwnCardinalityRestriction(
+    subClassEdges, cardinalityRestrictionEdges, subject,
+    (rec) => rec.onClass === onClass && rec.kind === "max" && rec.n === 0,
+    opts,
+  );
+  return found ? { subject, object: onClass, viaClass: found.viaClass, viaRestriction: found.viaRestriction } : null;
+}
+
 /**
  * PURE consistency checker (PLAN_INFERENCE_TESTING.md S1 INF-C2, S4 stage 5):
  * detects when a SINGLE subject's own already-asserted types contradict each
@@ -567,28 +893,32 @@ export function findConsistencyViolations(typeEdges, subClassEdges, disjointEdge
 /**
  * Run one bounded speculative pass over the memory graph under `repoDir`
  * (the repo dir whose .tmct/memory/graph.json appendFact/loadMemory manage).
- * Reads the stored subClassOf, rdf:type, owl:disjointWith AND (for cls-svf1)
- * owl:onProperty/owl:someValuesFrom + every other object-property fact,
- * forward-chains FOUR rules — scm-sco (⊑-transitivity) then cax-sco (type
- * propagation, seeing THIS pass's own scm-sco conclusions too, so a fresh
- * two-hop taught chain and its type propagation both materialize in one
+ * Reads the stored subClassOf, rdf:type, owl:disjointWith AND (for cls-svf1/
+ * scm-svf1) owl:onProperty/owl:someValuesFrom + every other object-property
+ * fact, forward-chains FIVE rules — scm-sco (⊑-transitivity) then cax-sco
+ * (type propagation, seeing THIS pass's own scm-sco conclusions too, so a
+ * fresh two-hop taught chain and its type propagation both materialize in one
  * call) then cax-dw (disjointness violations, seeing THIS pass's own scm-sco
  * AND cax-sco conclusions too) then cls-svf1 (someValuesFrom restriction
- * membership, also seeing the enlarged subClassOf set for its own ⊑-lift) —
- * and materializes each NEW conclusion via `appendFacts` with
+ * membership, also seeing the enlarged subClassOf set for its own ⊑-lift)
+ * then scm-svf1 (restriction-to-restriction subsumption, seeing the SAME
+ * enlarged subClassOf set — its own ⊑-lift over the two restrictions' filler
+ * classes) — and materializes each NEW conclusion via `appendFacts` with
  * `entailed:subClassOf`/`entailed:type`/`entailed:disjointWith`/
- * `entailed:someValuesFrom` provenance + trust (PLAN_INFERENCE_TESTING.md S4
- * stage 2's entailed hook: `min(premiseTrusts) x ruleConfidence` when the
- * conclusion's OWN premises are resolvable in the pre-pass snapshot, falling
- * back to the bare entailed prior — memory/trust.mjs's SOURCE_PRIOR floor —
- * when they are not, e.g. a premise itself only exists because THIS SAME
- * pass just derived it a round earlier; still low, still never outranks a
- * stated fact, just less precisely premise-derived for that one case).
+ * `entailed:someValuesFrom`/`entailed:someValuesFromSubsumption` provenance +
+ * trust (PLAN_INFERENCE_TESTING.md S4 stage 2's entailed hook:
+ * `min(premiseTrusts) x ruleConfidence` when the conclusion's OWN premises
+ * are resolvable in the pre-pass snapshot, falling back to the bare entailed
+ * prior — memory/trust.mjs's SOURCE_PRIOR floor — when they are not, e.g. a
+ * premise itself only exists because THIS SAME pass just derived it a round
+ * earlier; still low, still never outranks a stated fact, just less
+ * precisely premise-derived for that one case).
  *
  * opts:
  *   - depth   max fixpoint rounds (scm-sco chain growth), default 32
- *   - budget  max NEW derivations written this pass, SHARED across all four
- *             rules (scm-sco, then cax-sco, then cax-dw, then cls-svf1), default 50
+ *   - budget  max NEW derivations written this pass, SHARED across all five
+ *             rules (scm-sco, then cax-sco, then cax-dw, then cls-svf1, then
+ *             scm-svf1), default 50
  *   - focus   Set|array of class terms; when given, only derivations touching
  *             focus (subject, pivot, or object ∈ focus) are admitted. Omit for a
  *             whole-graph batch pass.
@@ -675,9 +1005,23 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
   const svf1Derived = remainingBudgetSvf1 > 0 && restrictionEdges.length
     ? deriveSomeValuesFromApplication(propertyEdges, typeEdges, enlargedSubClassEdges, restrictionEdges, { budget: remainingBudgetSvf1, focus: normalizedFocus })
     : [];
+  // scm-svf1 sees the SAME enlarged subClassOf set (its own ⊑-lift over the
+  // two restrictions' filler classes) and reuses the SAME restrictionEdges
+  // just built for cls-svf1 above — needs at least two independently-declared
+  // restrictions over one property to have anything to compare (the kernel's
+  // own guard, `deriveSomeValuesFromSubsumption`'s doc comment).
+  const remainingBudgetScmSvf = Math.max(0, budget - scmDerived.length - caxDerived.length - dwDerived.length - svf1Derived.length);
+  const scmSvfDerived = remainingBudgetScmSvf > 0 && restrictionEdges.length > 1
+    ? deriveSomeValuesFromSubsumption(restrictionEdges, enlargedSubClassEdges, { budget: remainingBudgetScmSvf, focus: normalizedFocus })
+    : [];
+  // scm-svf1's own two structural premises per restriction (owl:onProperty /
+  // owl:someValuesFrom) are looked up by restriction id — restrictionEdges
+  // already carries each restriction's (property, target) pair, keyed the
+  // same way `deriveSomeValuesFromSubsumption`'s own output does.
+  const restrictionByRid = new Map(restrictionEdges.map((r) => [r.restriction, r]));
 
   // Batched write: ONE mutateMemory pass for the whole pass's conclusions
-  // (all four rules), not one appendFact per derived fact — appendFacts (the
+  // (all five rules), not one appendFact per derived fact — appendFacts (the
   // appendUtterances-precedent batch path, memory/core.mjs) does the same
   // normalize+prose-tokenize+upsert work per fact but a SINGLE read-mutate-
   // write, so a pass with many derivations no longer pays per-fact I/O.
@@ -743,6 +1087,29 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
         ...(premiseTrusts.length ? { premiseTrusts, ruleConfidence: CLS_SVF1_RULE_CONFIDENCE } : {}),
       };
     }),
+    ...scmSvfDerived.map((d) => {
+      // each restriction's own two structural premises (owl:onProperty /
+      // owl:someValuesFrom rows), for BOTH restrictions being compared, plus
+      // the y1⊑y2 subClassOf premise that licensed the comparison — always
+      // present here (unlike cax-dw/cls-svf1's optional lift premise): the
+      // kernel's own tautology screen guarantees viaY1 !== viaY2 for every
+      // derived scm-svf1 fact (`deriveSomeValuesFromSubsumption`'s doc comment).
+      const r1 = restrictionByRid.get(d.subject);
+      const r2 = restrictionByRid.get(d.object);
+      const premiseTrusts = numericOnly([
+        r1 && premiseTrust(d.subject, ON_PROPERTY_PREDICATE, r1.property),
+        premiseTrust(d.subject, SOME_VALUES_FROM_PREDICATE, d.viaY1),
+        r2 && premiseTrust(d.object, ON_PROPERTY_PREDICATE, r2.property),
+        premiseTrust(d.object, SOME_VALUES_FROM_PREDICATE, d.viaY2),
+        premiseTrust(d.viaY1, SUBCLASS_PREDICATE, d.viaY2),
+      ]);
+      return {
+        subject: d.subject, predicate: SUBCLASS_PREDICATE, object: d.object,
+        provenance: ENTAILED_SCM_SVF_PROVENANCE,
+        // same sub-1 discount as cax-dw/cls-svf1, same reason (see CAX_DW_RULE_CONFIDENCE).
+        ...(premiseTrusts.length ? { premiseTrusts, ruleConfidence: SCM_SVF_RULE_CONFIDENCE } : {}),
+      };
+    }),
   ];
   const { ids } = await appendFacts(repoDir, toWrite);
   const written = [];
@@ -763,6 +1130,10 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
     written.push({ id: ids[i], subject: d.subject, object: d.object, via: d.viaValue, rule: CLS_SVF1_RULE });
     i += 1;
   }
+  for (const d of scmSvfDerived) {
+    written.push({ id: ids[i], subject: d.subject, object: d.object, via: d.viaY1, rule: SCM_SVF_RULE });
+    i += 1;
+  }
   return { derived: written, count: written.length, budget, depth, truncated: written.length >= budget };
 }
 

package/src/toml-config.mjs

@@ -7,7 +7,7 @@
 // behaviour, byte-for-byte).
 //
 // Three pure entry points, consumed later by the cli:
-//   loadTomlConfig(rootDir)          → raw parsed TOML, or null when absent
+//   loadTomlConfig(rootDir,{file})   → raw parsed TOML, or null when absent
 //   normalizeConfig(raw,{configDir}) → canonical sparse shape (present keys only)
 //   mergeEffective({args,toml,defaults}) → {effective, sources} (arg>toml>default)
 
@@ -17,12 +17,13 @@ import { parse } from "smol-toml";
 
 export const CONFIG_FILE = "tmct.toml";
 
-/** Read `<rootDir>/tmct.toml` and return the raw parsed table.
+/** Read `<rootDir>/tmct.toml` (or an explicit `{file}` override — `--config
+ *  <path>`, a file, not a dir) and return the raw parsed table.
  *  - Absent file → `null` (the "today" signal: shipped defaults, byte-identical).
  *  - Present but unparseable → throws a clear error naming the file + parse cause
  *    (a `secret_exclude` misparse is security-relevant — never swallow it). */
-export async function loadTomlConfig(rootDir) {
-  const file = join(rootDir, CONFIG_FILE);
+export async function loadTomlConfig(rootDir, { file: fileOverride } = {}) {
+  const file = fileOverride || join(rootDir, CONFIG_FILE);
   let text;
   try {
     text = await readFile(file, "utf8");
@@ -93,6 +94,14 @@ export async function normalizeConfig(raw, { configDir } = {}) {
   if (src.graph_file !== undefined) {
     cfg.graphFile = resolve(dir, String(src.graph_file));
   }
+  // `graph_files` (array, multi-graph — the CLI/config unification batch):
+  // sits ALONGSIDE `graph_file`, never replaces it. A single-element array is
+  // legal but `graph_file` stays the byte-identical single-graph path most
+  // repos use; `graph_files` only matters once it names more than one file.
+  if (src.graph_files !== undefined) {
+    const arr = Array.isArray(src.graph_files) ? src.graph_files : [src.graph_files];
+    cfg.graphFiles = arr.map((p) => resolve(dir, String(p)));
+  }
   const corpus = src.corpus || {};
   if (corpus.tier !== undefined) cfg.corpus = { tier: corpus.tier };
   const seed = src.seed || {};