Grounded Memory: 1.2 architecture and invariants
Representation before record count
Both inherited banks remain byte-identical to 1.1: 24 policies and 12,128 packed bytes total. The advance is executable memory infrastructure, not additional parameters. Database, indexes, proof structures, graphs and code are separate. There is no learned semantic encoder or hidden language model. A glossary write is new supplied information, not evidence of previously unknown meaning being inferred.
Scoped terminology bridges
remember_bridge(phrase, target, source=...) stores a single-valued assertion
under __retrieval_bridge__. It is a directed permission to rewrite a query phrase
inside that tenant/namespace. It is not an alias of the underlying factual entity
and is never used to merge claim values. An API writer can supply wrong mappings;
source provenance is visible, but the engine cannot establish semantic truth.
The search normalizes Unicode and case, matches phrase boundaries, and explores
at most 16 query variants / three steps by default (hard limits: 32 / four). Cycles
are deduplicated. A reachable conflicting or multivalued mapping causes conflict.
Exhausting expansion/depth bounds returns budget_exceeded, not a partial winner.
No quoted or hypothesized mapping is activated. Instruction-like records are not
used, but this limited heuristic is NOT a comprehensive prompt-injection defense.
Literal and topic features for all variants are measured against one eligible SQLite snapshot. Existing neural or conventional policies rank candidates. Selected records carry the exact rewrite dependencies. The top-k certificate is recomputed against storage before packing; caller-edited text is never trusted. Correction, TTL, deletion and cross-connection writes use the original validity rules. Deleted corrections cannot revive old mappings.
recall_grounded is explicit: existing recall retains its old narrow grammar and
topic fallback. A bridge is application data, not hardcoded global vocabulary.
Evidence packets remain related notes, with no inferred answer value.
Positive conjunctive queries
query({'where': [...], 'select': [...]}) joins up to six supplied fact predicates.
Variables bind case-sensitive NFKC-normalized entity/value strings; predicate
aliases use the declared relation map. Literal ?-prefixed terms use
{'literal':'?literal'}. No variable predicates, implicit transitivity, arbitrary
code, negation-as-failure, arithmetic, or external SQL are allowed.
The join orders atoms using supplied cardinalities. A work counter counts actual
candidate examinations. Default bounds are 50,000 examinations and 512 states;
exceeding them returns no partial rows. At most 128 full proof alternatives are
returned. Contradictory touched claims stop inference. no_matches describes only
the eligible snapshot, not absence in the world. The scope digest binds all eligible
records so an added new answer invalidates an old result even when its positive
support records did not change. This deliberately favors sound invalidation over
minimal invalidation; unrelated eligible writes can invalidate the certificate.
Complete-proof context optimization
The previous packer minimized each answer's proof independently. That can repeat large evidence records unnecessarily. The new optimizer evaluates combinations of one complete proof per answer and minimizes the actual serialized packet. Shared record IDs are paid for once. By default at most 4,096 combinations are examined; the configurable hard maximum is 65,536. This is exponential finite search, not an unbounded efficient solver.
No additive token lower bound is assumed: tokenization can merge across boundaries.
Every evaluated full packet is counted with the provided tokenizer (otherwise
UTF-8 bytes). optimal=true requires exhaustion of the candidate combination set.
A feasible incumbent may be returned with optimal=false after hitting the bound.
If no feasible incumbent is found before the search cap, the status is
search_exhausted, not a proof of infeasibility. budget_exceeded is reserved for
a fully searched choice set. In all cases, an incomplete proof is never emitted.
Certificates are not signatures
Recomputing a checksum is not sufficient to forge a supported result: revalidation reruns the plan and compares selected evidence. This detects tampering with the certificate content, but it does not protect against an authorized database writer inserting false claims. There are no external fact-verification or cryptographic identity guarantees. In-flight reads can legitimately reflect their initial snapshot; consequential actions must reauthorize independently.
Deployment separation
The authenticated production API serves one configured scope. The optional public Space serves only fixed synthetic cases; no live memory write endpoints are mounted. The client refuses cleartext remote bearer traffic and credential-bearing redirects. The Hub downloader fetches checkpoint data, not executable remote code.