13.3 Conclusions are computed, never stored — and they carry their why

Derived facts are an overlay: queries see conclusions consistent with the data at the moment they ask, no conclusion outlives the run that computed it, and removing the realm removes the label — there is no derived data to migrate or delete.

That guarantee is about what survives, not about what is never written. Under the transient execution model the evaluator’s writes happen inside a transaction that is rolled back, so they never land. Under the committed model they do land, on real nodes, and end-of-run cleanup reverses exactly them — recorded as they are applied, and journalled durably, so a run that dies before reaching its own cleanup is still reversed rather than leaving stamped labels behind. An author sees the same conclusions either way; an operator should know which model is in force, because only one of them has a crash window to reason about.

What the graph already holds is never taken away by a run. A conclusion may land where stored data already is, and the run treats that data as data:

• a node that already carries the derived label in storage is a member as it stands, and still carries the label after the run — derived and stored membership are a union;
• a stored relationship of the derived type between a concluded pair IS that conclusion, and is left exactly as it was (no second edge, nothing stamped on it);
• a head property whose value is already stored on the member — or head properties bound for a stored relationship — refuse the query, naming the property and the node. A stored value cannot be unioned with a computed one, and overwriting it to remove it afterwards would destroy it. Rename the derived property (prefix it for the realm, §13.5) or stop storing it.

A run that fails part-way — at its round cap or its pair budget — leaves nothing behind either: the graph after a failed run is the graph before it.

Every membership records its firing chain — which rule concluded it, in which round, with which values, and how values grew as membership grew. That trace is the mechanical object an explanation renders rather than reconstructs: “blocked because A (30%) and B (25%) together hold 55%” is read off the chain, not inferred after the fact. Rule bodies pass the same per-user scoping as every query, so a rule can never read what its author’s own query could not.

A conclusion is visible exactly where the nodes it annotates are. A derived label on nodes only its caller owns is the caller’s; a derived label on shared nodes is visible to whoever can see those nodes, and is answered as such — MATCH (t:HotTopic) over shared topics returns them to the caller that derived them, never an empty answer. Because a conclusion inherits its nodes’ audience, a rule set that would conclude from private facts onto nodes other users can read is refused before it runs: otherwise a shared node would carry a property computed from someone’s private data (a heat counting their private mail) for every reader to see. Conclude onto private nodes, or derive only from facts the shared node’s readers could see themselves.