# Grounded Memory: 1.2 architecture and invariants

## Representation before record count

Both inherited banks remain byte-identical to 1.1: 24 policies and 12,128 packed
bytes total. The advance is executable memory infrastructure, not additional
parameters. Database, indexes, proof structures, graphs and code are separate.
There is no learned semantic encoder or hidden language model. A glossary write is
new supplied information, not evidence of previously unknown meaning being inferred.

## Scoped terminology bridges

`remember_bridge(phrase, target, source=...)` stores a single-valued assertion
under `__retrieval_bridge__`. It is a directed permission to rewrite a query phrase
inside that tenant/namespace. It is not an alias of the underlying factual entity
and is never used to merge claim values. An API writer can supply wrong mappings;
source provenance is visible, but the engine cannot establish semantic truth.

The search normalizes Unicode and case, matches phrase boundaries, and explores
at most 16 query variants / three steps by default (hard limits: 32 / four). Cycles
are deduplicated. A reachable conflicting or multivalued mapping causes conflict.
Exhausting expansion/depth bounds returns `budget_exceeded`, not a partial winner.
No quoted or hypothesized mapping is activated. Instruction-like records are not
used, but this limited heuristic is NOT a comprehensive prompt-injection defense.

Literal and topic features for all variants are measured against one eligible
SQLite snapshot. Existing neural or conventional policies rank candidates.
Selected records carry the exact rewrite dependencies. The top-k certificate is
recomputed against storage before packing; caller-edited text is never trusted.
Correction, TTL, deletion and cross-connection writes use the original validity
rules. Deleted corrections cannot revive old mappings.

`recall_grounded` is explicit: existing `recall` retains its old narrow grammar and
topic fallback. A bridge is application data, not hardcoded global vocabulary.
Evidence packets remain related notes, with no inferred answer value.

## Positive conjunctive queries

`query({'where': [...], 'select': [...]})` joins up to six supplied fact predicates.
Variables bind case-sensitive NFKC-normalized entity/value strings; predicate
aliases use the declared relation map. Literal `?`-prefixed terms use
`{'literal':'?literal'}`. No variable predicates, implicit transitivity, arbitrary
code, negation-as-failure, arithmetic, or external SQL are allowed.

The join orders atoms using supplied cardinalities. A work counter counts actual
candidate examinations. Default bounds are 50,000 examinations and 512 states;
exceeding them returns no partial rows. At most 128 full proof alternatives are
returned. Contradictory touched claims stop inference. `no_matches` describes only
the eligible snapshot, not absence in the world. The scope digest binds all eligible
records so an added new answer invalidates an old result even when its positive
support records did not change. This deliberately favors sound invalidation over
minimal invalidation; unrelated eligible writes can invalidate the certificate.

## Complete-proof context optimization

The previous packer minimized each answer's proof independently. That can repeat
large evidence records unnecessarily. The new optimizer evaluates combinations of
one complete proof per answer and minimizes the actual serialized packet. Shared
record IDs are paid for once. By default at most 4,096 combinations are examined;
the configurable hard maximum is 65,536. This is exponential finite search, not an
unbounded efficient solver.

No additive token lower bound is assumed: tokenization can merge across boundaries.
Every evaluated full packet is counted with the provided tokenizer (otherwise
UTF-8 bytes). `optimal=true` requires exhaustion of the candidate combination set.
A feasible incumbent may be returned with `optimal=false` after hitting the bound.
If no feasible incumbent is found before the search cap, the status is
`search_exhausted`, not a proof of infeasibility. `budget_exceeded` is reserved for
a fully searched choice set. In all cases, an incomplete proof is never emitted.

## Certificates are not signatures

Recomputing a checksum is not sufficient to forge a supported result: revalidation
reruns the plan and compares selected evidence. This detects tampering with the
certificate content, but it does not protect against an authorized database writer
inserting false claims. There are no external fact-verification or cryptographic
identity guarantees. In-flight reads can legitimately reflect their initial
snapshot; consequential actions must reauthorize independently.

## Deployment separation

The authenticated production API serves one configured scope. The optional public
Space serves only fixed synthetic cases; no live memory write endpoints are mounted.
The client refuses cleartext remote bearer traffic and credential-bearing redirects.
The Hub downloader fetches checkpoint data, not executable remote code.