The vault follows a reference the question never named

A vault's answer is only as wide as what one search can reach, and some

questions are not shaped to be reached in one search. "Who took custody of

the paper arguing that the cure for faction is to extend the sphere?"

names an argument and a person, and the only thing joining the essay to

the custody register is a reference code that appears in neither the

question nor the asker's vocabulary. The join key is in the first result,

not in the query — so no amount of ranking, and no larger k, gets there.

So when a first search surfaces a reference code the question did not

contain, the vault searches again for that code, and the answering model

receives both halves.

Three properties are load-bearing. The second search is issued as the same

person, so it resolves the same compartment predicates as the first and

can never reach a document the asker could not already read — a hostile

document that plants a code buys itself a search over the asker's own

vault, not a disclosure. A question that surfaces nothing to follow pays

nothing at all: no extra search, no extra model call, no extra wait. And

the extraction is done by pattern rather than by asking a model what to

look up next, because a model asked that question is one more surface for

a document to give orders through.

One limit is worth knowing before you rely on this. It happens when you

ask through Think, or through the vault's tool interface — not on the

query page, where the model is shown exactly the passages you retrieved

and can see for yourself, and where adding a search on the server would

put text in front of it that you were never shown. So the same two-part

question follows a reference on one surface and not on the other.

A second limit is deliberate: only reference codes are followed, never

people's names. A name has no shape that separates it from any other pair

of capitalised words, so following names would mean following noise.

That the second search can never reach a compartment the asker could not

already reach is asserted against a real vault rather than here — a

scenario that mocked a compartment boundary would prove nothing about the

one that exists.