@polycode-projects/the-mechanical-code-talker 2.5.0 → 2.5.3

package/src/domain/syllogise.mjs

@@ -72,6 +72,11 @@ export const ENTAILED_SVF1_PROVENANCE = `entailed:${CLS_SVF1_RULE}`;
 /** Same sub-1 discount as CAX_DW_RULE_CONFIDENCE, same reason. */
 export const CLS_SVF1_RULE_CONFIDENCE = 0.95;
 
+/** The environment-set cap: how many independent premise sets one entailed
+ *  fact may carry as ' | '-separated mgx:factJustification environments — the
+ *  bounded-ATMS knob alongside depth/budget/focus. */
+export const DEFAULT_MAX_ENVIRONMENTS = 4;
+
 const SEP = "␟"; // an in-key separator no fact term can contain
 const isSubClassOf = (p) => String(p || "").trim().toLowerCase() === "rdfs:subclassof";
 const isType = (p) => String(p || "").trim().toLowerCase() === "rdf:type";
@@ -166,6 +171,79 @@ export function deriveSubClassClosure(edges, { depth = 32, budget = 50, focus =
   return derived;
 }
 
+/**
+ * PURE semi-naive subClassOf closure: the delta twin of
+ * `deriveSubClassClosure`, same contract exactly (only-new `{ subject,
+ * object, via }` conclusions, tautology/dedup/focus screens, the same
+ * per-round candidate sort, identical `budget`/`depth` semantics). Instead of
+ * re-joining the whole relation each round, round one joins only
+ * `deltaEdges` against the full relation (Δ∘R and R∘Δ — Δ∘Δ falls out of Δ∘R
+ * because `allEdges` contains the delta rows too), and each later round joins
+ * only what the previous round committed. When the non-delta part of
+ * `allEdges` is already closed (a prior pass ran to fixpoint), the output
+ * equals the full kernel's novel output, order included.
+ */
+export function deriveSubClassClosureDelta(allEdges, deltaEdges, { depth = 32, budget = 50, focus = null } = {}) {
+  const present = new Set();      // "a\0b" for every edge already known
+  const succ = new Map();         // a -> Set(b): the live successor relation
+  const pred = new Map();         // b -> Set(a): its inverse, for the R∘Δ join
+  for (const [a, b] of allEdges || []) {
+    if (!a || !b || a === b) continue;
+    present.add(`${a}${SEP}${b}`);
+    if (!succ.has(a)) succ.set(a, new Set());
+    succ.get(a).add(b);
+    if (!pred.has(b)) pred.set(b, new Set());
+    pred.get(b).add(a);
+  }
+  let delta = [];
+  const seenDelta = new Set();
+  for (const [a, b] of deltaEdges || []) {
+    if (!a || !b || a === b) continue;
+    const key = `${a}${SEP}${b}`;
+    if (seenDelta.has(key)) continue;
+    seenDelta.add(key);
+    delta.push([a, b]);
+  }
+  const focusSet = focus instanceof Set ? (focus.size ? focus : null) : normalizeFocus(focus);
+  const inFocus = (a, b, c) => !focusSet || focusSet.has(a) || focusSet.has(b) || focusSet.has(c);
+
+  const derived = [];
+  const derivedKeys = new Set();
+  for (let round = 0; round < depth && delta.length; round += 1) {
+    const additions = [];
+    const consider = (a, b, c) => {
+      if (a === c) return;                                    // tautology screen (reflexive)
+      const key = `${a}${SEP}${c}`;
+      if (present.has(key) || derivedKeys.has(key)) return;   // dedup / novelty screen
+      if (!inFocus(a, b, c)) return;                          // focus-connection screen
+      additions.push([a, b, c, key]);
+    };
+    for (const [a, b] of delta) {
+      for (const c of succ.get(b) || []) consider(a, b, c);   // Δ∘R
+      for (const z of pred.get(a) || []) consider(z, a, b);   // R∘Δ
+    }
+    if (!additions.length) break; // fixpoint reached
+    additions.sort((x, y) => x[0].localeCompare(y[0]) || x[2].localeCompare(y[2]) || x[1].localeCompare(y[1]));
+    let progressed = false;
+    const nextDelta = [];
+    for (const [a, b, c, key] of additions) {
+      if (derivedKeys.has(key)) continue; // an earlier addition this round covered it
+      if (derived.length >= budget) break;
+      derivedKeys.add(key);
+      derived.push({ subject: a, object: c, via: b });
+      if (!succ.has(a)) succ.set(a, new Set());
+      succ.get(a).add(c);
+      if (!pred.has(c)) pred.set(c, new Set());
+      pred.get(c).add(a);
+      nextDelta.push([a, c]);
+      progressed = true;
+    }
+    if (derived.length >= budget || !progressed) break; // budget hit or nothing committed
+    delta = nextDelta;
+  }
+  return derived;
+}
+
 /**
  * Shared closure machinery: given `subClassEdges` ([[a,b], …], already-
  * normalized), returns a memoized `ancestorsOf(c)` that walks the FULL
@@ -200,6 +278,52 @@ function buildAncestorCloser(subClassEdges) {
   };
 }
 
+/** `buildAncestorCloser` with the edges reversed: a memoized
+ *  `descendantsOf(c)` walking every SUBclass reachable below `c`. */
+function buildDescendantCloser(subClassEdges) {
+  return buildAncestorCloser((subClassEdges || []).map(([a, b]) => [b, a]));
+}
+
+/**
+ * PURE relevance frontier: the set of terms a change touching `seedTerms`
+ * can actually affect, over the fact `rows` given. Seeds (normalized) plus
+ * the ⊑-descendant closure of each seed (a new edge above a class affects
+ * everything below it), plus every instance carrying a stored type in that
+ * affected-class set, plus every declared someValuesFrom restriction node
+ * whose target filler class sits in it. Over-approximation is harmless — the
+ * kernels' own dedup screens drop anything already known — while a term the
+ * frontier misses simply waits for the next full pass. The same structure
+ * serves forward relevance (a delta pass's focus) that `retractSubClassOf`'s
+ * citedBy index serves backward.
+ */
+export function buildRelevanceFrontier(rows, seedTerms) {
+  const subClassEdges = [];
+  const typeEdges = [];
+  const onPropertyOf = new Map();      // restriction -> owl:onProperty's object
+  const someValuesFromOf = new Map();  // restriction -> owl:someValuesFrom's object
+  for (const r of rows || []) {
+    if (!r || !r.subject || !r.predicate || !r.object) continue;
+    if (isSubClassOf(r.predicate)) subClassEdges.push([r.subject, r.object]);
+    else if (isType(r.predicate)) typeEdges.push([r.subject, r.object]);
+    else if (isOnProperty(r.predicate)) onPropertyOf.set(r.subject, r.object);
+    else if (isSomeValuesFrom(r.predicate)) someValuesFromOf.set(r.subject, r.object);
+  }
+  const descendantsOf = buildDescendantCloser(subClassEdges);
+  const affectedClasses = new Set();
+  for (const t of seedTerms || []) {
+    const n = normFactTerm(t);
+    if (!n) continue;
+    affectedClasses.add(n);
+    for (const d of descendantsOf(n)) affectedClasses.add(d);
+  }
+  const frontier = new Set(affectedClasses);
+  for (const [x, c] of typeEdges) if (affectedClasses.has(c)) frontier.add(x);
+  for (const [restriction, target] of someValuesFromOf) {
+    if (onPropertyOf.has(restriction) && affectedClasses.has(target)) frontier.add(restriction);
+  }
+  return frontier;
+}
+
 /**
  * PURE cax-sco: rdf:type propagation across a subClassOf chain — (x rdf:type
  * C), (C ⊑ … ⊑ D) ⊨ (x rdf:type D). `subClassEdges` is a fixed input (unlike
@@ -207,13 +331,18 @@ function buildAncestorCloser(subClassEdges) {
  * class (`buildAncestorCloser`) covers the whole chain — no fixpoint rounds
  * needed. Returns ONLY new `{ subject, object, via }` conclusions, bounded by
  * `budget`, focus-filtered, tautology- and dedup-screened, deterministic order.
+ *
+ * `presentTypeEdges` (defaults to `typeEdges`) feeds ONLY the novelty screen:
+ * a delta caller that pre-filters `typeEdges` to the relevant slice passes the
+ * FULL list here, so an already-stored conclusion outside the slice is still
+ * recognized as known rather than re-derived.
  */
-export function deriveTypePropagation(typeEdges, subClassEdges, { budget = 50, focus = null } = {}) {
+export function deriveTypePropagation(typeEdges, subClassEdges, { budget = 50, focus = null, presentTypeEdges = typeEdges } = {}) {
   const ancestorsOf = buildAncestorCloser(subClassEdges);
 
   const present = new Set(); // "x\0C" for every rdf:type edge already known
   const seenTypeEdge = new Set(); // dedup repeated (x,C) input rows
-  for (const [x, c] of typeEdges || []) if (x && c) present.add(`${x}${SEP}${c}`);
+  for (const [x, c] of presentTypeEdges || []) if (x && c) present.add(`${x}${SEP}${c}`);
   const focusSet = focus instanceof Set ? (focus.size ? focus : null) : normalizeFocus(focus);
   const inFocus = (x, c, d) => !focusSet || focusSet.has(x) || focusSet.has(c) || focusSet.has(d);
 
@@ -664,18 +793,47 @@ export function findConsistencyViolations(typeEdges, subClassEdges, disjointEdge
  * (`min(premiseTrusts) x ruleConfidence`) when premises are resolvable in the
  * pre-pass snapshot, else falls back to the bare entailed prior.
  *
+ * After the kernels, an ALTERNATE-DISCOVERY step (bounded by the same budget
+ * number, spent separately) enumerates additional premise environments for
+ * this pass's conclusions and for stored purely-entailed facts still under
+ * the `maxEnvironments` cap, so a fact's justification accretes every
+ * independent derivation route retraction can later check by set membership.
+ *
+ * SEMI-NAIVE DELTA MODE: when the store carries a watermark from the last
+ * complete pass (the optional `loadSyllogiseState`/`saveSyllogiseState` store
+ * members), no caller focus is given, no fact was removed since, and `full`
+ * was not forced, the pass runs delta evaluation — scm-sco joins only the
+ * since-watermark rows (`deriveSubClassClosureDelta`), and the four later
+ * kernels are scoped by a relevance frontier built from the delta
+ * (`buildRelevanceFrontier`) plus per-kernel input pre-filters. Conclusions
+ * are identical to a full pass (the dedup screens make over-approximation
+ * harmless); what shrinks is candidate generation and the joins — the pass
+ * still pays the store snapshot read. The watermark advances ONLY after an
+ * unfocused pass that ends at a natural fixpoint.
+ *
  * opts: `depth` (max fixpoint rounds, default 32), `budget` (max new
  * derivations this pass, shared across all five rules, default 50), `focus`
  * (Set|array of class terms scoping derivations to what touches it — omit
- * for a whole-graph pass), `store` (REQUIRED — the memory store's
+ * for a whole-graph pass), `expandFocus` (default false: when true, a caller
+ * focus expands through `buildRelevanceFrontier` before the kernels run, so
+ * a derivation among the focus terms' descendants and instances is in scope
+ * even when none of its own three terms was named), `maxEnvironments`
+ * (per-fact environment cap,
+ * default DEFAULT_MAX_ENVIRONMENTS), `full` (force full evaluation even with
+ * a valid watermark), `store` (REQUIRED — the memory store's
  * { loadMemory, readFactRows, appendFacts } read/write functions, injected so
- * this inference module never imports the store itself).
+ * this inference module never imports the store itself; optional
+ * loadSyllogiseState/saveSyllogiseState enable delta mode).
  *
  * Returns { derived: [{ id, subject, object, via, rule }], count, budget,
- * depth, truncated }.
+ * depth, truncated, mode, deltaSize, environmentsAdded, alternatesTruncated }.
  */
-export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null, store } = {}) {
+export async function syllogise(repoDir, {
+  depth = 32, budget = 50, focus = null, expandFocus = false,
+  maxEnvironments = DEFAULT_MAX_ENVIRONMENTS, full = false, store,
+} = {}) {
   const { loadMemory, readFactRows, appendFacts } = requireStore(store, ["loadMemory", "readFactRows", "appendFacts"], "syllogise");
+  const stateFnsPresent = typeof store?.loadSyllogiseState === "function" && typeof store?.saveSyllogiseState === "function";
   const memory = await loadMemory(repoDir);
   const rows = readFactRows(memory);
   const subClassEdges = rows.filter((r) => isSubClassOf(r.predicate)).map((r) => [r.subject, r.object]);
@@ -699,7 +857,25 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
     const target = someValuesFromOf.get(restriction);
     if (target) restrictionEdges.push({ restriction, property, target });
   }
-  const normalizedFocus = normalizeFocus(focus);
+  const callerFocus = normalizeFocus(focus);
+  // An expanded focus is the same relevance walk a delta pass runs, seeded by
+  // the caller's terms instead of a change set — still a focus (never reads
+  // or advances the watermark), just one that reaches the descendants,
+  // instances and restrictions the named terms actually govern.
+  const normalizedFocus = expandFocus && callerFocus
+    ? buildRelevanceFrontier(rows, [...callerFocus])
+    : callerFocus;
+
+  // Mode: delta only with a valid watermark (state present, nothing removed
+  // since — an id-set diff catches retractions, snapshots and hand-edits),
+  // no caller focus, and no forced full. Anything else is a full pass.
+  const state = normalizedFocus === null && stateFnsPresent ? await store.loadSyllogiseState(repoDir) : null;
+  const currentIdSet = new Set(rows.map((r) => r.id));
+  const removedSinceLast = Array.isArray(state?.factIds) ? state.factIds.filter((id) => !currentIdSet.has(id)) : [];
+  const mode = state && Array.isArray(state.factIds) && !removedSinceLast.length && !full ? "delta" : "full";
+  const watermark = mode === "delta" ? new Set(state.factIds) : null;
+  const deltaRows = mode === "delta" ? rows.filter((r) => !watermark.has(r.id)) : rows;
+  const deltaSize = deltaRows.length;
 
   // Pre-pass trust snapshot for the entailed hook's premiseTrusts lookup,
   // wired for cax-dw/cls-svf1/scm-svf1 only: with ruleConfidence defaulting
@@ -713,33 +889,93 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
   const hasTriple = (s, p, o) => trustByTriple.has(`${s}${SEP}${p}${SEP}${o}`);
   const numericOnly = (arr) => arr.filter((t) => typeof t === "number");
 
-  const scmDerived = deriveSubClassClosure(subClassEdges, { depth, budget, focus: normalizedFocus });
+  // An empty delta derives nothing by construction — and an empty frontier
+  // must never be handed to the kernels as focus, because an empty focus Set
+  // means "whole graph" to normalizeFocus. Skipping the kernels outright is
+  // both the honest and the cheap reading.
+  const deltaEmpty = mode === "delta" && !deltaRows.length;
+  const deltaSubEdges = mode === "delta"
+    ? deltaRows.filter((r) => isSubClassOf(r.predicate)).map((r) => [r.subject, r.object])
+    : [];
+  const scmDerived = mode === "delta"
+    ? (deltaSubEdges.length ? deriveSubClassClosureDelta(subClassEdges, deltaSubEdges, { depth, budget, focus: normalizedFocus }) : [])
+    : deriveSubClassClosure(subClassEdges, { depth, budget, focus: normalizedFocus });
   // cax-sco sees the ENLARGED subClassOf edge set (stated ∪ this pass's own
   // scm-sco conclusions) so both rules complete in one `tmct syllogise` call.
   const enlargedSubClassEdges = subClassEdges.concat(scmDerived.map((d) => [d.subject, d.object]));
+
+  // Delta mode scopes the four later kernels by the relevance frontier: built
+  // AFTER scm-sco over the enlarged edge set, seeded by every term of every
+  // delta row, then applied as their focus plus per-kernel input pre-filters.
+  let kernelFocus = normalizedFocus;
+  let frontier = null;
+  if (mode === "delta" && !deltaEmpty) {
+    const frontierRows = rows.concat(scmDerived.map((d) => ({ subject: d.subject, predicate: SUBCLASS_PREDICATE, object: d.object })));
+    const seeds = [];
+    for (const r of deltaRows) seeds.push(r.subject, r.object);
+    frontier = buildRelevanceFrontier(frontierRows, seeds);
+    kernelFocus = frontier;
+  }
+  const inFrontier = (t) => !frontier || frontier.has(t);
+  // cax-sco's inputs narrow to the frontier's type edges, but its NOVELTY set
+  // must still see every stored type edge (presentTypeEdges) — otherwise the
+  // filtered call re-derives stored conclusions and idempotency breaks.
+  const caxTypeEdges = frontier ? typeEdges.filter(([x, c]) => inFrontier(x) || inFrontier(c)) : typeEdges;
+  // cax-dw additionally keeps any type whose ⊑-ancestry reaches an endpoint
+  // of a delta disjointWith row — a new disjointness above an old type is
+  // invisible to the frontier's descendant walk.
+  const deltaDwEndpoints = new Set();
+  if (frontier) {
+    for (const r of deltaRows) {
+      if (isDisjoint(r.predicate)) { deltaDwEndpoints.add(r.subject); deltaDwEndpoints.add(r.object); }
+    }
+  }
+  const dwAncestorsOf = frontier && deltaDwEndpoints.size ? buildAncestorCloser(enlargedSubClassEdges) : null;
+  const dwTypeEdges = frontier
+    ? typeEdges.filter(([x, c]) => inFrontier(x) || inFrontier(c)
+      || (dwAncestorsOf && [...dwAncestorsOf(c)].some((a) => deltaDwEndpoints.has(a))))
+    : typeEdges;
+  // cls-svf1's property edges narrow to the frontier — plus every edge over a
+  // property whose restriction declaration is itself in the delta, so a new
+  // restriction reaches old edges; its type edges stay FULL (they feed the
+  // novelty screen and the filler-type join).
+  const deltaRestrictionProperties = new Set();
+  if (frontier) {
+    for (const r of deltaRows) {
+      if (isOnProperty(r.predicate) || isSomeValuesFrom(r.predicate)) {
+        const property = onPropertyOf.get(r.subject);
+        if (property) deltaRestrictionProperties.add(normFactTerm(property));
+      }
+    }
+  }
+  const svf1PropertyEdges = frontier
+    ? propertyEdges.filter(([x, p, y]) => inFrontier(x) || inFrontier(y) || deltaRestrictionProperties.has(normFactTerm(p)))
+    : propertyEdges;
+
   const remainingBudget = Math.max(0, budget - scmDerived.length);
-  const caxDerived = remainingBudget > 0
-    ? deriveTypePropagation(typeEdges, enlargedSubClassEdges, { budget: remainingBudget, focus: normalizedFocus })
+  const caxDerived = remainingBudget > 0 && !deltaEmpty
+    ? deriveTypePropagation(caxTypeEdges, enlargedSubClassEdges, { budget: remainingBudget, focus: kernelFocus, presentTypeEdges: typeEdges })
     : [];
   // cax-dw sees the SAME enlarged subClassOf set (so its own ⊑-lift reaches a
   // chain scm-sco just grew this pass) — it doesn't need the enlarged TYPE
   // edge set too, since it walks each direct type's own ⊑-ancestor closure.
   const remainingBudgetDw = Math.max(0, budget - scmDerived.length - caxDerived.length);
-  const dwDerived = remainingBudgetDw > 0
-    ? deriveDisjointViolations(typeEdges, enlargedSubClassEdges, disjointEdges, { budget: remainingBudgetDw, focus: normalizedFocus })
+  const dwDerived = remainingBudgetDw > 0 && !deltaEmpty
+    ? deriveDisjointViolations(dwTypeEdges, enlargedSubClassEdges, disjointEdges, { budget: remainingBudgetDw, focus: kernelFocus })
     : [];
   // cls-svf1 sees the SAME enlarged subClassOf set (its own ⊑-lift) but NOT
   // the enlarged type edge set, so a same-pass cax-sco conclusion on `y`
   // can't be consumed before a human can audit it.
   const remainingBudgetSvf1 = Math.max(0, budget - scmDerived.length - caxDerived.length - dwDerived.length);
-  const svf1Derived = remainingBudgetSvf1 > 0 && restrictionEdges.length
-    ? deriveSomeValuesFromApplication(propertyEdges, typeEdges, enlargedSubClassEdges, restrictionEdges, { budget: remainingBudgetSvf1, focus: normalizedFocus })
+  const svf1Derived = remainingBudgetSvf1 > 0 && restrictionEdges.length && !deltaEmpty
+    ? deriveSomeValuesFromApplication(svf1PropertyEdges, typeEdges, enlargedSubClassEdges, restrictionEdges, { budget: remainingBudgetSvf1, focus: kernelFocus })
     : [];
   // scm-svf1 reuses the SAME restrictionEdges built for cls-svf1 above —
-  // needs at least two restrictions over one property to compare.
+  // needs at least two restrictions over one property to compare. In delta
+  // mode the frontier scopes it as focus only, no input pre-filter.
   const remainingBudgetScmSvf = Math.max(0, budget - scmDerived.length - caxDerived.length - dwDerived.length - svf1Derived.length);
-  const scmSvfDerived = remainingBudgetScmSvf > 0 && restrictionEdges.length > 1
-    ? deriveSomeValuesFromSubsumption(restrictionEdges, enlargedSubClassEdges, { budget: remainingBudgetScmSvf, focus: normalizedFocus })
+  const scmSvfDerived = remainingBudgetScmSvf > 0 && restrictionEdges.length > 1 && !deltaEmpty
+    ? deriveSomeValuesFromSubsumption(restrictionEdges, enlargedSubClassEdges, { budget: remainingBudgetScmSvf, focus: kernelFocus })
     : [];
   const restrictionByRid = new Map(restrictionEdges.map((r) => [r.restriction, r]));
 
@@ -749,16 +985,18 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
     ...scmDerived.map((d) => ({
       subject: d.subject, predicate: SUBCLASS_PREDICATE, object: d.object,
       provenance: ENTAILED_PROVENANCE,
-      // Persisted justification: the premise fact ids this conclusion rode
-      // (a⊑b, b⊑c) — content-addressed ids work even when a premise is
-      // itself an entailment this same pass just derived. Read back by
+      // Persisted justification: one environment per independent derivation,
+      // each an ordered premise fact-id list — this first one is the premise
+      // set the conclusion rode (a⊑b, b⊑c); the alternate-discovery step
+      // below may append more. Content-addressed ids work even when a premise
+      // is itself an entailment this same pass just derived. Read back by
       // retractSubClassOf (below) to find every entailment a retracted
       // premise could have supported. All five rules persist one, each
       // citing its own premise shape.
-      justification: [
+      justification: [[
         factIdForTriple(d.subject, SUBCLASS_PREDICATE, d.via),
         factIdForTriple(d.via, SUBCLASS_PREDICATE, d.object),
-      ],
+      ]],
     })),
     ...caxDerived.map((d) => ({
       subject: d.subject, predicate: TYPE_PREDICATE, object: d.object,
@@ -767,10 +1005,10 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
       // taught chain is multi-hop: scm-sco materialises that edge (this same
       // pass or an earlier one), and retraction re-VERIFIES every candidate
       // anyway, so a citation left dangling by budget truncation is inert.
-      justification: [
+      justification: [[
         factIdForTriple(d.subject, TYPE_PREDICATE, d.via),
         factIdForTriple(d.via, SUBCLASS_PREDICATE, d.object),
-      ],
+      ]],
     })),
     ...dwDerived.map((d) => {
       // disjointWith is symmetric, taught as ONE direction — the premise row
@@ -788,11 +1026,11 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
       return {
         subject: d.subject, predicate: DISJOINT_PREDICATE, object: d.object,
         provenance: ENTAILED_DISJOINT_PROVENANCE,
-        justification: [
+        justification: [[
           factIdForTriple(d.subject, TYPE_PREDICATE, d.viaType),
           factIdForTriple(dwS, DISJOINT_PREDICATE, dwO),
           ...(d.viaClass !== d.viaType ? [factIdForTriple(d.viaType, SUBCLASS_PREDICATE, d.viaClass)] : []),
-        ],
+        ]],
         ...(premiseTrusts.length ? { premiseTrusts, ruleConfidence: CAX_DW_RULE_CONFIDENCE } : {}),
       };
     }),
@@ -809,13 +1047,13 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
       return {
         subject: d.subject, predicate: TYPE_PREDICATE, object: d.object,
         provenance: ENTAILED_SVF1_PROVENANCE,
-        justification: [
+        justification: [[
           factIdForTriple(d.subject, d.viaProperty, d.viaValue),
           factIdForTriple(d.viaValue, TYPE_PREDICATE, d.viaType),
           factIdForTriple(d.object, ON_PROPERTY_PREDICATE, d.viaPropertyKey),
           factIdForTriple(d.object, SOME_VALUES_FROM_PREDICATE, d.viaTarget),
           ...(d.viaType !== d.viaTarget ? [factIdForTriple(d.viaType, SUBCLASS_PREDICATE, d.viaTarget)] : []),
-        ],
+        ]],
         // same sub-1 discount as cax-dw, same reason (see CAX_DW_RULE_CONFIDENCE).
         ...(premiseTrusts.length ? { premiseTrusts, ruleConfidence: CLS_SVF1_RULE_CONFIDENCE } : {}),
       };
@@ -833,18 +1071,76 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
       return {
         subject: d.subject, predicate: SUBCLASS_PREDICATE, object: d.object,
         provenance: ENTAILED_SCM_SVF_PROVENANCE,
-        justification: [
+        justification: [[
           ...(r1 ? [factIdForTriple(d.subject, ON_PROPERTY_PREDICATE, r1.property)] : []),
           factIdForTriple(d.subject, SOME_VALUES_FROM_PREDICATE, d.viaY1),
           ...(r2 ? [factIdForTriple(d.object, ON_PROPERTY_PREDICATE, r2.property)] : []),
           factIdForTriple(d.object, SOME_VALUES_FROM_PREDICATE, d.viaY2),
           factIdForTriple(d.viaY1, SUBCLASS_PREDICATE, d.viaY2),
-        ],
+        ]],
         // same sub-1 discount as cax-dw/cls-svf1, same reason (see CAX_DW_RULE_CONFIDENCE).
         ...(premiseTrusts.length ? { premiseTrusts, ruleConfidence: SCM_SVF_RULE_CONFIDENCE } : {}),
       };
     }),
   ];
+
+  // ---- alternate-environment discovery ----
+  // Enumerate additional premise environments for this pass's conclusions and
+  // for stored purely-entailed facts still under the cap, so retraction can
+  // later keep a multiply-derived fact by set membership instead of a
+  // re-derivation. The examination spends its own copy of the budget number —
+  // it never competes with the derivation budget above.
+  const conclusionCandidates = toWrite.map((w) => ({
+    id: factIdForTriple(w.subject, w.predicate, w.object),
+    subject: w.subject, predicate: w.predicate, object: w.object,
+    environments: w.justification,
+    write: w,
+  }));
+  const enumerateSupport = buildSupportEnumerator(rows.concat(conclusionCandidates.map((c) => ({
+    id: c.id, subject: c.subject, predicate: c.predicate, object: c.object,
+  }))));
+  const rowById = new Map(rows.map((r) => [r.id, r]));
+  const ownedPredicate = (p) => isSubClassOf(p) || isType(p) || isDisjoint(p);
+  // Delta mode examines only stored facts the frontier touches; an alternate
+  // enabled solely by a change outside it (e.g. a new filler type for
+  // cls-svf1) waits for the next full pass — retraction stays correct either
+  // way through its enumerate/boolean fallbacks.
+  const storedCandidateInScope = (r) => mode !== "delta"
+    || (frontier !== null && (frontier.has(r.subject) || frontier.has(r.object)));
+  const storedCandidates = rows
+    .filter((r) => ownedPredicate(r.predicate) && isPurelyEntailed(r.provenance)
+      && environmentsOf(r).length < maxEnvironments && storedCandidateInScope(r))
+    .map((r) => ({
+      id: r.id, subject: r.subject, predicate: r.predicate, object: r.object,
+      environments: environmentsOf(r), provenance: r.provenance,
+    }));
+  const alternateCandidates = [...conclusionCandidates, ...storedCandidates]
+    .sort((a, b) => a.subject.localeCompare(b.subject) || a.predicate.localeCompare(b.predicate) || a.object.localeCompare(b.object));
+  let environmentsAdded = 0;
+  let alternatesTruncated = false;
+  let examined = 0;
+  for (const cand of alternateCandidates) {
+    if (examined >= budget) { alternatesTruncated = true; break; }
+    examined += 1;
+    // Enumerate one PAST the cap so a distinct environment falling to the cap
+    // is visible to the merge below and honestly reported as truncation.
+    const discovered = enumerateSupport(cand, { maxEnvironments: maxEnvironments + 1 });
+    const { kept, truncated: mergeTruncated } = capMergeEnvironments(cand.environments, discovered, maxEnvironments);
+    if (mergeTruncated) alternatesTruncated = true;
+    if (kept.length <= cand.environments.length) continue; // nothing new to record
+    environmentsAdded += kept.length - cand.environments.length;
+    if (cand.write) { cand.write.justification = kept; continue; }
+    // A stored fact gains its newly discovered environments via a minimal
+    // upsert row: provenance omitted (first-write-wins keeps the union), and
+    // the three premise-discounted rules re-state their best environment's
+    // trusts so the entailed hook stays engaged through the trust recompute.
+    toWrite.push({
+      subject: cand.subject, predicate: cand.predicate, object: cand.object,
+      justification: kept,
+      ...(bestEnvironmentTrustOpts(cand.provenance, kept, (pid) => rowById.get(pid)?.trust) || {}),
+    });
+  }
+
   const { ids } = await appendFacts(repoDir, toWrite);
   const written = [];
   let i = 0;
@@ -868,7 +1164,24 @@ export async function syllogise(repoDir, { depth = 32, budget = 50, focus = null
     written.push({ id: ids[i], subject: d.subject, object: d.object, via: d.viaY1, rule: SCM_SVF_RULE });
     i += 1;
   }
-  return { derived: written, count: written.length, budget, depth, truncated: written.length >= budget };
+  const truncated = written.length >= budget;
+
+  // The watermark advances ONLY after an unfocused pass whose derivations
+  // ended at a natural fixpoint — a truncated or focused pass has not seen
+  // everything, so its id set must not masquerade as a completed frontier.
+  // alternatesTruncated does not block: alternates change justifications,
+  // never which conclusions exist.
+  if (normalizedFocus === null && stateFnsPresent && !truncated) {
+    const factIds = new Set(currentIdSet);
+    for (const id of ids) factIds.add(id);
+    await store.saveSyllogiseState(repoDir, {
+      version: 1, factIds: [...factIds].sort(), completedAt: new Date().toISOString(),
+    });
+  }
+  return {
+    derived: written, count: written.length, budget, depth, truncated,
+    mode, deltaSize, environmentsAdded, alternatesTruncated,
+  };
 }
 
 /** True when EVERY provenance tag on a fact's (possibly " | "-joined) union is
@@ -968,6 +1281,219 @@ function buildSurvivorDerivabilityCheck(rows) {
   };
 }
 
+/** A row's persisted environments, upgrading a store whose readFactRows
+ *  predates the environment field: a bare justification list reads as one
+ *  environment. */
+const environmentsOf = (row) => row.environments
+  || (Array.isArray(row.justification) && row.justification.length ? [row.justification] : []);
+
+/** Builds the environment ENUMERATOR: given ONLY the fact rows in `rows`,
+ *  returns `(row, { maxEnvironments }) => string[][]` — every premise-id set
+ *  (up to the cap) that independently derives the row's (s,p,o) conclusion
+ *  under the rule families that own its predicate, in a fixed deterministic
+ *  order, each environment citing ids in the same order the write path
+ *  cites them. An environment counts only when EVERY cited id resolves to a
+ *  row in `rows` and none is the row's own id — stricter than
+ *  buildSurvivorDerivabilityCheck's closure walk (a multi-hop ⊑ premise with
+ *  no materialised direct edge enumerates nothing), which is why that boolean
+ *  check stays the final authority in retraction. Pure, no I/O. */
+function buildSupportEnumerator(rows) {
+  const storedIds = new Set();
+  const subClassEdges = [];
+  const succ = new Map();             // a -> Set(direct stored superclass)
+  const typesOf = new Map();          // x -> Set(direct stored types)
+  const disjointForward = new Set();  // "a␟b" per stored disjointWith row, as-stored orientation
+  const disjointOf = new Map();       // term -> Set(partners), symmetric
+  const onPropertyOf = new Map();     // restriction -> owl:onProperty's object
+  const someValuesFromOf = new Map(); // restriction -> owl:someValuesFrom's object
+  const propertyEdgesOf = new Map();  // x -> [[rawPredicate, y], …]
+  for (const r of rows) {
+    if (!r || !r.subject || !r.predicate || !r.object) continue;
+    if (r.id) storedIds.add(r.id);
+    const pLower = String(r.predicate || "").trim().toLowerCase();
+    if (isSubClassOf(r.predicate)) {
+      subClassEdges.push([r.subject, r.object]);
+      if (!succ.has(r.subject)) succ.set(r.subject, new Set());
+      succ.get(r.subject).add(r.object);
+    } else if (isType(r.predicate)) {
+      if (!typesOf.has(r.subject)) typesOf.set(r.subject, new Set());
+      typesOf.get(r.subject).add(r.object);
+    } else if (isDisjoint(r.predicate)) {
+      disjointForward.add(`${r.subject}${SEP}${r.object}`);
+      if (!disjointOf.has(r.subject)) disjointOf.set(r.subject, new Set());
+      disjointOf.get(r.subject).add(r.object);
+      if (!disjointOf.has(r.object)) disjointOf.set(r.object, new Set());
+      disjointOf.get(r.object).add(r.subject);
+    } else if (isOnProperty(r.predicate)) onPropertyOf.set(r.subject, r.object);
+    else if (isSomeValuesFrom(r.predicate)) someValuesFromOf.set(r.subject, r.object);
+    else if (!RESERVED_PREDICATES.has(pLower)) {
+      if (!propertyEdgesOf.has(r.subject)) propertyEdgesOf.set(r.subject, []);
+      propertyEdgesOf.get(r.subject).push([r.predicate, r.object]);
+    }
+  }
+  const ancestorsOf = buildAncestorCloser(subClassEdges);
+  const succOf = (a) => succ.get(a) || new Set();
+  const restrictionOf = (node) => {
+    const property = onPropertyOf.get(node);
+    const target = someValuesFromOf.get(node);
+    return property && target ? { property, propertyKey: normFactTerm(property), target } : null;
+  };
+
+  return (row, { maxEnvironments = DEFAULT_MAX_ENVIRONMENTS } = {}) => {
+    const out = [];
+    const seen = new Set();
+    const admit = (env) => {
+      if (out.length >= maxEnvironments) return;
+      if (row.id && env.includes(row.id)) return; // self-support is no support
+      if (!env.every((id) => storedIds.has(id))) return; // a dangling citation makes the whole set inert
+      const key = [...env].sort().join(" ");
+      if (seen.has(key)) return;
+      seen.add(key);
+      out.push(env);
+    };
+
+    if (isSubClassOf(row.predicate)) {
+      // scm-sco: each pivot m with stored direct s⊑m and m⊑o edges.
+      for (const m of [...succOf(row.subject)].sort()) {
+        if (out.length >= maxEnvironments) break;
+        if (m === row.subject || m === row.object) continue;
+        if (!succOf(m).has(row.object)) continue;
+        admit([
+          factIdForTriple(row.subject, SUBCLASS_PREDICATE, m),
+          factIdForTriple(m, SUBCLASS_PREDICATE, row.object),
+        ]);
+      }
+      // scm-svf1: both ends declared restrictions over the SAME property with
+      // a stored direct filler ⊑.
+      if (out.length < maxEnvironments) {
+        const r1 = restrictionOf(row.subject);
+        const r2 = restrictionOf(row.object);
+        if (r1 && r2 && r1.propertyKey === r2.propertyKey && r1.target !== r2.target
+          && succOf(r1.target).has(r2.target)) {
+          admit([
+            factIdForTriple(row.subject, ON_PROPERTY_PREDICATE, r1.property),
+            factIdForTriple(row.subject, SOME_VALUES_FROM_PREDICATE, r1.target),
+            factIdForTriple(row.object, ON_PROPERTY_PREDICATE, r2.property),
+            factIdForTriple(row.object, SOME_VALUES_FROM_PREDICATE, r2.target),
+            factIdForTriple(r1.target, SUBCLASS_PREDICATE, r2.target),
+          ]);
+        }
+      }
+      return out;
+    }
+    if (isType(row.predicate)) {
+      // cax-sco: each stored type c with a stored direct c⊑D edge.
+      for (const c of [...(typesOf.get(row.subject) || [])].sort()) {
+        if (out.length >= maxEnvironments) break;
+        if (c === row.object) continue;
+        if (!succOf(c).has(row.object)) continue;
+        admit([
+          factIdForTriple(row.subject, TYPE_PREDICATE, c),
+          factIdForTriple(c, SUBCLASS_PREDICATE, row.object),
+        ]);
+      }
+      // cls-svf1: D a declared restriction, each stored property edge over its
+      // property whose value's type hits the target directly or by one stored
+      // direct ⊑ edge.
+      const rec = restrictionOf(row.object);
+      if (rec) {
+        const edges = [...(propertyEdgesOf.get(row.subject) || [])]
+          .filter(([p]) => normFactTerm(p) === rec.propertyKey)
+          .sort((a, b) => a[0].localeCompare(b[0]) || a[1].localeCompare(b[1]));
+        for (const [p, y] of edges) {
+          if (out.length >= maxEnvironments) break;
+          for (const c of [...(typesOf.get(y) || [])].sort()) {
+            if (out.length >= maxEnvironments) break;
+            if (c !== rec.target && !succOf(c).has(rec.target)) continue;
+            admit([
+              factIdForTriple(row.subject, p, y),
+              factIdForTriple(y, TYPE_PREDICATE, c),
+              factIdForTriple(row.object, ON_PROPERTY_PREDICATE, rec.propertyKey),
+              factIdForTriple(row.object, SOME_VALUES_FROM_PREDICATE, rec.target),
+              ...(c !== rec.target ? [factIdForTriple(c, SUBCLASS_PREDICATE, rec.target)] : []),
+            ]);
+          }
+        }
+      }
+      return out;
+    }
+    if (isDisjoint(row.predicate)) {
+      // cax-dw: each stored type c and lift class d whose stored disjoint row
+      // reaches the conclusion's object (orientation as stored).
+      const pairs = [];
+      for (const c of typesOf.get(row.subject) || []) {
+        for (const d of [c, ...ancestorsOf(c)]) {
+          if ((disjointOf.get(d) || new Set()).has(row.object)) pairs.push([c, d]);
+        }
+      }
+      pairs.sort((a, b) => a[0].localeCompare(b[0]) || a[1].localeCompare(b[1]));
+      for (const [c, d] of pairs) {
+        if (out.length >= maxEnvironments) break;
+        const dwStoredForward = disjointForward.has(`${d}${SEP}${row.object}`);
+        const [dwS, dwO] = dwStoredForward ? [d, row.object] : [row.object, d];
+        admit([
+          factIdForTriple(row.subject, TYPE_PREDICATE, c),
+          factIdForTriple(dwS, DISJOINT_PREDICATE, dwO),
+          ...(d !== c ? [factIdForTriple(c, SUBCLASS_PREDICATE, d)] : []),
+        ]);
+      }
+      return out;
+    }
+    return out; // a predicate no rule family owns enumerates nothing
+  };
+}
+
+/** Merge already-stored environments with newly discovered ones under the
+ *  cap: stored first (their order preserved), then discoveries in enumeration
+ *  order, deduped by canonical key, truncated at `cap`. Returns
+ *  { kept, truncated } — truncated true when a distinct environment was
+ *  dropped for the cap. */
+function capMergeEnvironments(storedEnvs, discoveredEnvs, cap) {
+  const kept = [];
+  const seen = new Set();
+  let truncated = false;
+  for (const env of [...(storedEnvs || []), ...(discoveredEnvs || [])]) {
+    if (!Array.isArray(env) || !env.length) continue;
+    const key = [...env].sort().join(" ");
+    if (seen.has(key)) continue;
+    if (kept.length >= cap) { truncated = true; continue; }
+    seen.add(key);
+    kept.push(env);
+  }
+  return { kept, truncated };
+}
+
+const ENTAILED_RULE_CONFIDENCE_BY_TAG = new Map([
+  [ENTAILED_DISJOINT_PROVENANCE, CAX_DW_RULE_CONFIDENCE],
+  [ENTAILED_SVF1_PROVENANCE, CLS_SVF1_RULE_CONFIDENCE],
+  [ENTAILED_SCM_SVF_PROVENANCE, SCM_SVF_RULE_CONFIDENCE],
+]);
+
+/** The entailed-hook opts for re-stating a conclusion of one of the three
+ *  premise-discounted rules: the BEST environment's premise trusts (max over
+ *  environments of min(premise trusts); tie → the earlier environment) plus
+ *  the rule's confidence — without this, recomputeFactTrust would silently
+ *  reset a discounted conclusion to the bare entailed prior. Null for
+ *  scm-sco/cax-sco conclusions (which ride the bare prior by design) and when
+ *  no environment's premises all resolve to a numeric trust. */
+function bestEnvironmentTrustOpts(provenance, environments, trustOfId) {
+  let ruleConfidence;
+  for (const tag of String(provenance || "").split(" | ")) {
+    const rc = ENTAILED_RULE_CONFIDENCE_BY_TAG.get(tag);
+    if (rc !== undefined) { ruleConfidence = rc; break; }
+  }
+  if (ruleConfidence === undefined) return null;
+  let best = null;
+  let bestMin = -1;
+  for (const env of environments || []) {
+    const trusts = env.map((id) => trustOfId(id)).filter((t) => typeof t === "number");
+    if (trusts.length !== env.length) continue; // a premise with no resolvable trust can't price the environment
+    const weakest = Math.min(...trusts);
+    if (weakest > bestMin) { bestMin = weakest; best = trusts; }
+  }
+  return best ? { premiseTrusts: best, ruleConfidence } : null;
+}
+
 /**
  * A scoped retraction slice: DRed (delete-and-rederive; Gupta, Mumick &
  * Subrahmanian, SIGMOD 1993), NOT JTMS. It recomputes the MATERIALISATION —
@@ -989,16 +1515,26 @@ function buildSurvivorDerivabilityCheck(rows) {
  * justifications into every rule's conclusions (transitive ⊑, propagated
  * types, disjointness violations, restriction membership and subsumption).
  *
- * A survivor keeps its stale, still-single justification as-is; a later
- * retraction of its OTHER supporting path therefore won't re-examine it.
- * Re-grounding survivors — or tracking every alternate justification set —
- * is the ATMS horizon, not this bounded slice.
+ * Each candidate is checked in three steps, cheapest first: (1) FAST PATH —
+ * any stored environment untouched by the cascade and fully backed by
+ * surviving rows keeps the fact by set membership alone; (2) ENUMERATE — a
+ * fresh premise environment found among the survivors re-grounds it; (3) the
+ * BOOLEAN BACKSTOP — the closure-walking derivability check, which sees
+ * multi-hop support the enumerator's stored-direct-edge discipline cannot
+ * cite, stays the final authority. A survivor whose environments changed is
+ * RE-GROUNDED after the removal (its pruned or fresh environments written
+ * back) when the store carries `appendFacts` — an OPTIONAL seam member:
+ * without it removal is still correct, the survivor's environments just stay
+ * stale until the next syllogise pass.
  *
  * Returns { retracted, count, budget, depth, truncated, found } — `found` is
  * false when `subject ⊑ object` was never a stored fact.
  */
-export async function retractSubClassOf(repoDir, subject, object, { budget = 50, depth = 32, store } = {}) {
+export async function retractSubClassOf(repoDir, subject, object, {
+  budget = 50, depth = 32, maxEnvironments = DEFAULT_MAX_ENVIRONMENTS, store,
+} = {}) {
   const { loadMemory, readFactRows, removeFacts } = requireStore(store, ["loadMemory", "readFactRows", "removeFacts"], "retractSubClassOf");
+  const appendFactsFn = typeof store?.appendFacts === "function" ? store.appendFacts : null;
   const s = normFactTerm(subject);
   const o = normFactTerm(object);
   const targetId = factIdForTriple(s, SUBCLASS_PREDICATE, o);
@@ -1009,50 +1545,105 @@ export async function retractSubClassOf(repoDir, subject, object, { budget = 50,
 
   // Only a purely-entailed fact ever carries a walkable justification —
   // a fact later independently taught is never a cascade candidate at all.
-  const entailedRows = rows.filter((r) => r.justification.length && isPurelyEntailed(r.provenance));
+  const entailedRows = rows.filter((r) => environmentsOf(r).length && isPurelyEntailed(r.provenance));
+  // premise id -> the entailed fact ids whose environments cite it. Built
+  // ONCE; each round's candidate set reads it for the facts the newest
+  // removals could actually touch — backward relevance from the same
+  // structure a forward pass reads forward.
+  const citedBy = new Map();
+  for (const r of entailedRows) {
+    for (const env of environmentsOf(r)) {
+      for (const premiseId of env) {
+        if (!citedBy.has(premiseId)) citedBy.set(premiseId, new Set());
+        citedBy.get(premiseId).add(r.id);
+      }
+    }
+  }
 
   const removed = new Set([targetId]);
   const order = [targetId]; // deterministic report order: target first, then removal order
+  const reground = new Map(); // survivor fact id -> the environments to persist for it
   let truncated = false;
   let round = 0;
+  let newlyRemoved = [targetId];
   for (; round < depth; round += 1) {
-    const candidates = entailedRows
-      .filter((r) => !removed.has(r.id) && r.justification.some((j) => removed.has(j)))
+    const candidateIds = new Set();
+    for (const id of newlyRemoved) {
+      for (const cited of citedBy.get(id) || []) {
+        if (!removed.has(cited)) candidateIds.add(cited);
+      }
+    }
+    const candidates = [...candidateIds].map((id) => byId.get(id))
       .sort((a, b) => a.subject.localeCompare(b.subject) || a.predicate.localeCompare(b.predicate) || a.object.localeCompare(b.object));
-    if (!candidates.length) break; // fixpoint — nothing left to (re-)check
+    if (!candidates.length) break; // fixpoint — nothing cites what just fell
 
-    // The surviving fact set for THIS round's verify walk excludes every
-    // candidate's own row too, not just `removed` — otherwise a candidate
-    // could trivially "reach itself" through its own not-yet-deleted edge, or
-    // lean on a sibling candidate standing on the same broken premise.
-    const candidateIds = new Set(candidates.map((c) => c.id));
-    const stillDerivable = buildSurvivorDerivabilityCheck(
-      rows.filter((r) => !removed.has(r.id) && !candidateIds.has(r.id)),
-    );
+    // The surviving fact set for THIS round excludes every candidate's own
+    // row too, not just `removed` — otherwise a candidate could trivially
+    // "reach itself" through its own not-yet-deleted edge, or lean on a
+    // sibling candidate standing on the same broken premise.
+    const survivors = rows.filter((r) => !removed.has(r.id) && !candidateIds.has(r.id));
+    const survivorIds = new Set(survivors.map((r) => r.id));
+    const enumerateSupport = buildSupportEnumerator(survivors);
+    const stillDerivable = buildSurvivorDerivabilityCheck(survivors);
 
     let progressed = false;
     let hitBudget = false;
+    newlyRemoved = [];
     for (const c of candidates) {
       if (removed.size >= budget) { hitBudget = true; break; }
-      // does the conclusion still hold WITHOUT the retracted premise, via ANY
-      // surviving derivation (not just the one this fact was originally
-      // derived through)? A survivor keeps its (now possibly re-groundable,
-      // still TRUE) fact and is never re-examined again this call.
-      if (stillDerivable(c)) continue; // a second, independent derivation still supports it — keep
+      // FAST PATH: an environment whose every premise still stands keeps the
+      // fact — pure set membership, no re-derivation. When some environments
+      // broke, queue the pruned set so the next retraction still sees the
+      // survivor (the stale-justification fix).
+      const environments = environmentsOf(c);
+      const intact = environments.filter((env) => env.every((id) => survivorIds.has(id)));
+      if (intact.length) {
+        if (intact.length !== environments.length) reground.set(c.id, intact);
+        continue;
+      }
+      // ENUMERATE: a fresh premise environment among the survivors re-grounds
+      // the fact under new citations.
+      const fresh = enumerateSupport(c, { maxEnvironments });
+      if (fresh.length) {
+        reground.set(c.id, fresh);
+        continue;
+      }
+      // BOOLEAN BACKSTOP: the closure walk is the final authority — it sees
+      // multi-hop support with no materialised direct edge to cite, so a
+      // still-derivable fact is never removed on a stale citation alone (its
+      // environments stay as they were).
+      if (stillDerivable(c)) continue;
       removed.add(c.id);
       order.push(c.id);
+      newlyRemoved.push(c.id);
       progressed = true;
     }
     if (hitBudget) { truncated = true; break; }
-    if (!progressed) break; // every candidate this round survived verification — fixpoint
+    if (!progressed) break; // every candidate this round survived — fixpoint
   }
   if (!truncated && round >= depth) {
-    // depth exhausted, not a natural fixpoint — honestly flag it if a
-    // pending candidate would still have been checked next round.
+    // depth exhausted, not a natural fixpoint — honestly flag it if a pending
+    // candidate (any surviving fact whose environment union still cites a
+    // removed id) would have been checked next round.
     truncated = entailedRows.some((r) => !removed.has(r.id) && r.justification.some((j) => removed.has(j)));
   }
 
   const { removed: actuallyRemoved } = await removeFacts(repoDir, order);
+  if (appendFactsFn) {
+    const regroundWrites = [...reground.entries()]
+      .filter(([id]) => !removed.has(id))
+      .sort((a, b) => a[0].localeCompare(b[0]))
+      .map(([id, environments]) => {
+        const row = byId.get(id);
+        return {
+          subject: row.subject, predicate: row.predicate, object: row.object,
+          // provenance omitted — appendFacts' first-write-wins keeps the union
+          justification: environments,
+          ...(bestEnvironmentTrustOpts(row.provenance, environments, (pid) => byId.get(pid)?.trust) || {}),
+        };
+      });
+    if (regroundWrites.length) await appendFactsFn(repoDir, regroundWrites);
+  }
   return { retracted: actuallyRemoved, count: actuallyRemoved.length, budget, depth, truncated, found: true };
 }