core/docs/adr/ADR-0258-member-chain-band.md

# ADR-0258 — Member-chain band (Band v3-MEM): singular membership + universal premises

- **Status:** Proposed
- **Date:** 2026-07-23
- **Relates to:** ADR-0257 (Band v2-EN — this is its scope-out #1), ADR-0256
  (earned license), ADR-0201 (ROBDD keystone), ADR-0175/0199 (calibrated
  learning / arena), ADR-0253 (dual-pack serve boundary — grc/he)

## 1. Context

ADR-0257 §6.1 reserved the classic instantiation syllogism as the next band:

> "Socrates is a man. All men are mortal. Therefore Socrates is mortal."

Band v2-EN refuses it (`membership_shape_out_of_band` — an `is a|an` clause
announces internal structure the opaque band must not flatten), Band v1b's
categorical decider has no notion of an *individual* (its terms are classes),
and the v1 propositional reader declines multi-word names. The eval lane pins
the gap: `ds-en-0022` is gold-`declined` purely for want of a reading band.
The engine underneath was never the limit.

## 2. Decision

Add a dedicated **member-argument reader + per-individual propositional
lowering** (`generate/proof_chain/member.py`), used ONLY by the deduction
serving path as a fallback tier strictly AFTER Bands v1 / v1b / v2-EN (so
every previously-served argument is byte-identical; this band only widens):

- **Closed sentence grammar** (function-word dispatch, refusal-first):
  - Singular fact — `<NAME> is [not] [a|an] <CLASS>` (contractions expanded,
    plus the sentential `it is not the case that <singular>` prefix). `<NAME>`
    and `<CLASS>` are opaque token runs; `is` only (no tense in v1).
  - Universal — `all|every|each <C1> are|is [a|an] <C2>` (affirmative A-form)
    and `no <C1> are|is [a|an] <C2>` (negative E-form).
  - Conclusion — final sentence, sole `therefore`-led, **singular form only**.
- **Per-individual propositional lowering:** collect the named individuals
  (subjects of singular sentences, conclusion included); mint one opaque atom
  per *(individual, class)* pair; each universal instantiates at EVERY named
  individual — `A(C1,C2)` ⇒ `mem(i,C1) -> mem(i,C2)`, `E(C1,C2)` ⇒
  `mem(i,C1) -> ~mem(i,C2)` for each `i`; singular facts are literals. The
  same verified ROBDD engine decides; deterministic templates render the
  verdict over the user's own sentences
  (`generate/proof_chain/render.py::render_entailment_member`).
- **Number linking (the one semantic identification this band performs):**
  a universal's class word is usually plural ("all men") while the singular
  fact uses the singular ("a man"). Two *attested* class tokens are identified
  iff related by a **closed morphology table** — a curated irregular/invariant
  table (men↔man, people↔person, children↔child, …; invariants like sheep,
  species, news map only to themselves) consulted FIRST, then the three
  regular suffix rules (`+s`, `+es` after sibilants, `y↔ies`). Table priority
  kills the over-link hazards (specie/species, new/news); anything the closed
  relation cannot relate stays distinct — under-linking costs coverage
  (honest UNKNOWN), never soundness. Linking is per-token, so multi-token
  classes ("guard dog"↔"guard dogs") link on the head noun.
- **Four new shape-bands** — `en_member_single` (exactly 1 universal),
  `en_member_chain` (≥2 universals), `en_member_negative` (any E-form),
  `en_member_atomic` (0 universals); priority negative > chain > single >
  atomic — each **earning its own SERVE license** through the ADR-0199 arena
  at n=720/band wrong=0, sealed into the same ratified ledger (unlicensed ⇒
  automatically hedged, per ADR-0256).

## 3. Why the lowering is sound (the load-bearing argument)

1. **Universal instantiation is sound.** Every first-order model of
   `∀x (C1(x) → C2(x))` satisfies its instantiation at each named individual,
   so any model of the premises is a model of the lowered premise set. An
   ENTAILED/REFUTED/inconsistent verdict over the lowered set therefore holds
   in every model of the original premises — served at full strength. Both
   verdicts survive even if two distinct names co-refer: adding equality
   facts only ADDS premises, and entailment is monotone.
2. **For this closed fragment the lowering is also complete.** With premises
   restricted to singular literals and A/E universals (Boolean reading, no
   existential import) and a singular conclusion, a propositional countermodel
   lifts to a first-order countermodel whose domain is exactly the named
   individuals — every universal holds because every element is a named
   individual whose instantiation holds. So UNKNOWN means genuinely not
   forced *within the disclosed reading* — it is never an artifact of
   instantiating too little.
3. **UNKNOWN is still the one guarded verdict.** Two readings could settle
   what the lowering leaves open: distinct names might co-refer, and class
   words the closed relation didn't link might be the same class. The UNKNOWN
   surface therefore scopes itself — *"Reading each name as one individual
   and each class word at face value…"* — same discipline as v2-EN's
   indivisible-clause scoping (ADR-0257 §3).
4. **Existential forms refuse out of band.** `some/most/any/…`-led sentences
   assert anonymous witnesses that per-individual lowering cannot represent —
   `quantifier_out_of_band`, typed. Pure categorical arguments stay with
   Band v1b (tried first, unchanged).

Structural guards (closed refusal vocabulary, all typed): `quantifier_out_of_band`,
`bare_plural_out_of_band` ("Dogs are loyal" — implicit genericity is a reading
this band refuses to guess), `definite_description_out_of_band` ("is the …" is
identity, not membership), `relative_clause_out_of_band` (`that/which/who`
inside a name or class), `universal_conclusion_out_of_band` (categorical
conclusions belong to v1b), `mixed_structure_out_of_band` (`if/or/either/and`
— conditional-membership fusion is a future band), `internal_negation_unread`,
`structural_leak`, `sentence_shape_out_of_band`, plus the v2-EN sentence
discipline (`question_sentence`, `no_conclusion`, `multiple_conclusions`,
`conclusion_not_last`, `no_premises`, `empty_side`, `empty`) and the honesty
caps (`too_many_premises` at 16, `too_many_atoms` at 24 minted pairs — refuse,
never truncate).

## 4. What the earned licenses certify

Same posture as ADR-0257 §4: the license certifies READER fidelity per shape
(the engine cannot be wrong; the reader can hand it the wrong problem). The
arena corpus is synthetic names × a class lexicon chosen to exercise every
row-type of the morphology table (irregular, invariant, `+s`, `+es`, `y↔ies`);
gold is authored by construction and cross-checked against the truth-table
oracle over the template's INTENDED instantiated formulas — no reader in the
loop (INV-25). The hand-authored real-English eval lane
(`evals/deduction_serve/v2_member/`, content disjoint from the synthetic
lexicon) keeps the structural-fidelity claim honest against natural prose,
including the promoted `ds-en-0022` (declined → entailed: this band's designed
acceptance case).

## 5. Tri-language posture

Unchanged from ADR-0257 §5 — with one addition: the number-linking table is
CORE's **first morphology table**, and it is exactly the artifact class the
tri-language doctrine says must eventually enter through pack ratification
(ADR-0253). English needs ~30 closed rows; Greek/Hebrew declension is where a
curated morphology pack stops being optional. When a `grc_*`/`he_*` member
band is built, the table moves from module constants to a ratified pack; no
premature parameterization now.

## 6. Scope-outs (deliberate)

1. **Conditional–membership fusion** ("If Socrates is a man then …") —
   refuses `mixed_structure_out_of_band`; a future band composes the v2-EN
   connective grammar with this band's sentence readings.
2. **Existential premises/conclusions** (`some …`) — needs witness semantics;
   pure categorical `some` stays with Band v1b.
3. **Tense** (`was/were`) and **verb predicates** ("Socrates runs") — refuse;
   verb morphology is ADR-0257 scope-out #2's territory.
4. **Identity / definite descriptions / co-reference** — refuse
   (`definite_description_out_of_band`); an equality-aware band is future work.
5. **Flag posture unchanged:** rides `deduction_serving_enabled` (default
   off); no new flag.

## 7. Verification

- `uv run core test --suite deductive -q` — reader contract, surfaces,
  license, all three lane splits, e2e through `ChatRuntime`.
- Practice arena: 13 bands × 720 = 9,360 cases, wrong=0 required for every
  band; ledger re-sealed (`chat/data/deduction_serve_ledger.json`).
- Eval lane: v1 28/28, v2_en 26/26 (ds-en-0022 promoted), v2_member new —
  wrong=0; report re-pinned (`scripts/verify_lane_shas.py`).