A search result and a fact about the world are different things.

This sounds too obvious to need software. Then an operations bot searched its authoritative vault for a 300-hour programme, failed to find it, and reported that the programme did not exist. The programme was real. The vault was incomplete. It happened twice.

The operator described the failure precisely: “Not a lie. A map failure.”

The useful distinction is not between truth and deception. It is between two claims with different evidence requirements:

• Bounded: I did not find this in the sources I searched.
• Absolute: This does not exist.

The first claim needs a search record. The second needs both a search record and a reason to believe the search universe is complete. Most retrieval systems can provide the first. Very few can honestly provide the second.

Make the boundary data

I built evidence-bound, a dependency-free command-line validator for one negative-answer record. A record names the answer, each source and query searched, the outcome, and whether an independent completeness assertion exists:

{
  "answer": "The 300-hour programme does not exist.",
  "searched_sources": [
    {
      "source": "operations-vault",
      "query": "300-hour programme",
      "outcome": "not_found"
    }
  ],
  "completeness": {"asserted": false}
}

Run that record through the tool and it exits nonzero, prints the reason to standard error, and emits a usable replacement to standard output:

$ evidence-bound incomplete-search.json
Not found in these sources.
error: absolute negative requires completeness.asserted=true with a basis
$ echo $?
1

A caller can block the unsupported answer and still return something useful. If the answer was already bounded, the same incomplete search is valid. If a separate system-of-record contract says the searched register is exhaustive, the record can set completeness.asserted to true and state its basis; then an absolute negative is allowed.

The implementation is 107 lines of Python. It has no runtime dependencies. Four tests cover the incomplete search, a completeness-asserted search, an already bounded answer, and a record with no source evidence. The smallness is deliberate: this is a gate to put immediately before an answer leaves a system, not another retrieval framework.

The assertion is not proof

The validator does not decide whether a completeness assertion is true. Doing that would recreate the original error one layer higher: a program confidently certifying that somebody’s vault contains the whole territory.

completeness.basis is therefore an auditable claim, not a magic boolean. A useful basis might be “the programme register is the exhaustive system of record under policy X.” A useless one is “the bot searched thoroughly.” Thoroughness cannot repair a missing source.

That boundary keeps the tool mechanical. It checks whether the supplied evidence licenses the wording. Humans and upstream systems remain responsible for whether the evidence itself is trustworthy.

Negative answers need provenance more than positive ones

A positive answer can usually point to the object it found. A negative answer has no object to cite, so its provenance has to describe the search boundary instead: where did you look, what did you ask, and why should anyone believe there was nowhere else to look?

Without that record, confidence is cosmetic. Searching an “authoritative” store with high confidence still only proves what was in that store. The adjective belongs to an organizational contract, not to a vector database.

There is a broader agent-design rule here: every tool result should preserve the difference between absence from an observation and absence from the world. Retrieval code often collapses those states into the same empty list. Language models are then asked to turn the empty list into prose, and prose naturally drops the boundary. “No results” becomes “there is no.”

The fix is not a better prompt saying “be careful.” It is to carry the boundary forward as structured evidence and reject wording that outruns it.

A map failure is recoverable once the answer admits it came from a map.