Open-World and Inconsistency: Abstention and Repair

📍 Where we are: Part VI · Annotated and Temporal Logic — Chapter 21. Temporal Reasoning ended caught between two failure modes: a base that says too little and abstains, or one that says too much and contradicts itself. This chapter names both precisely and asks the question the algebra could raise but not answer — what should a reasoner actually do about each?

Symbolic knowledge lives under two constraints that a beginner meets as surprises and an expert treats as the ground rules. The first is that not knowing a fact is not the same as knowing it false — a reasoner that respects this will sometimes, correctly, refuse to answer. The second is that a single contradiction is not a small local error but a global catastrophe: in classical logic, from a contradiction everything follows, so one clashing pair of facts turns a knowledge base into a machine that "proves" any claim you ask it. This chapter is about detecting, containing, and recovering from both — the honest "unknown" and the ruinous "everything."

The simple version

Imagine a detective's case file. If a fact is not written in the file, a careful detective does not conclude it never happened — she says "we do not know yet" and keeps the case open. That is the open world: silence means unknown, not no. Now suppose two witnesses gave flatly contradictory statements. A naive clerk who trusts every page equally could "derive" absolutely anything from the file, because a contradiction can be twisted to support any conclusion at all. So the detective quarantines the contradiction and works from the statements that still hang together. Abstaining when the file is silent, and rebuilding a consistent story when it clashes — that is the whole chapter.

What this chapter covers

• Open world versus closed world — the open-world assumption (OWA) of description logic and OWL treats an unstated fact as unknown; the closed-world assumption (CWA) of Datalog and databases treats it as false; the same query gets different answers, shown in a table over the academic world.
• Abstention as the honest answer — under OWA the right reply to "is alice a dean?" is unknown, not no, and why that differs from negation-as-failure.
• Inconsistency and explosion — the classical principle that a contradiction entails everything, and how the from-scratch reasoner's bottom rule flags the academic world's two unsatisfiable concepts before any of them can detonate the whole base.
• The chase that never stops — a real non-terminating run: undecidable termination means a reasoner can loop forever, and the step cap is a guard, not a cure.
• Repair and inconsistency-tolerant semantics — answers certain under every maximal consistent subset (a repair), so a query still returns trustworthy answers over a partly broken base.
• Graded trust when repairing — confidence lets a system prefer higher-trust facts while repairing; abstention plus graded trust is a recurring neuro-symbolic pattern.
• The unsolved part — deciding what to do about missing or contradictory knowledge is genuinely open and application-specific.

Open world versus closed world

Every reasoner has to take a stand on what absence means. Under the closed-world assumption (CWA), the world is assumed fully described: if a fact is not in the database and not derivable, it is taken to be false [1]. This is the assumption a SQL database and a Datalog program make, and it is exactly right when your data is complete — an airline's own booking table really does list all its bookings, so "no row" honestly means "no booking."

Description logic and OWL make the opposite choice, the open-world assumption (OWA): the stated facts are a partial description, and a fact that is neither entailed nor contradicted is unknown. Formally, for a knowledge base $\mathcal{K} = \langle \mathcal{T}, \mathcal{A}\rangle$ (a TBox of axioms $\mathcal{T}$ and an ABox of assertions $\mathcal{A}$) and a ground claim $C(a)$, exactly one of three cases holds:

$$\mathcal{K} \models C(a) \quad\text{(entailed: true in every model)}, \qquad \mathcal{K} \models \neg C(a) \quad\text{(refuted)}, \qquad \text{neither} \quad\text{(unknown)}.$$

The symbol $\models$ reads "entails" — a claim is entailed when it holds in every model of the knowledge base, refuted when its negation is, and unknown when some models say yes and others say no. CWA is the extra rule that erases the third case by fiat: not entailed is rewritten as false. That rewrite is the declarative counterpart of what logic programming calls negation-as-failure — a claim is taken false the moment the reasoner fails to prove it. The two are close cousins rather than one thing: CWA is the semantic assumption that unprovable ground atoms are false, and negation-as-failure is the operational rule that realizes it, the two coinciding for the definite and stratified programs Datalog runs.

Run the two policies against the academic world — the EL++ ontology of ontology.py, which reports itself as "10 named concepts, 6 roles, 14 TBox axioms; ABox: 13 concept assertions, 18 role assertions over 13 individuals" — and the same four queries split apart:

query	OWA (DL / OWL)	CWA (Datalog / database)
Professor(alice) — asserted in the ABox	true	true
Researcher(alice) — entailed via Professor ⊑ Researcher	true	true
Dean(alice) — neither asserted nor entailed	unknown	false
advises(alice, carol) — not an ABox role assertion	unknown	false

The first two rows agree: an asserted fact and a genuinely entailed one are true under either policy. The bottom two rows are where the assumptions part ways, and they part ways precisely on the facts nobody wrote down.

Abstention: unknown is an answer

Look closely at Dean(alice). The ABox asserts Professor(alice) and advises(alice, bob), and bob is a professor too — so alice is a professor who advises a professor. But the two dean axioms, Dean ⊑ Professor and Dean ⊑ ∃advises.Professor (ontology.py lines 151–152), state only necessary conditions of deanship, not sufficient ones. Being a professor who advises a professor does not make you a dean; nothing in the TBox concludes Dean from those facts. So Dean(alice) is true in some models and false in others, and an OWA reasoner answers unknown — it abstains.

That abstention is the honest answer, and it is different from the closed-world "no." Negation-as-failure would look up Dean(alice), fail to derive it, and report false — a confident denial. The OWA reasoner reports that it cannot tell, which is the truthful state of an incomplete knowledge base: the university's records simply may not have logged alice's administrative role. Absence of evidence is not evidence of absence. This is why OWL is built for the web, where no single source is ever complete: a reasoner that silently converted every gap into a "no" would manufacture false denials by the million. The cost of that honesty is that OWA reasoners answer fewer questions — the price of never lying is sometimes saying nothing.

Inconsistency and explosion: the bottom rule earns its keep

Abstention is the mild failure. The severe one is inconsistency, and classical logic treats it with zero tolerance. The principle of explosion (ex falso quodlibet, "from falsehood, anything") says a contradiction entails every sentence whatsoever:

$$\{\,\varphi,\ \neg\varphi\,\} \models \psi \quad\text{for every } \psi, \qquad\text{equivalently}\qquad \bot \models \psi .$$

The bottom concept $\bot$ (owl:Nothing) is the concept no individual can belong to; once a reasoner is forced to place some individual in $\bot$, the knowledge base has no model at all, and by the definition of entailment — true in every model — a claim true in every one of zero models is vacuously every claim. A single clash and the base "proves" that alice is a dean, that she is not, and that the moon is a professor, all at once. Such a base is not slightly wrong; it is useless.

So an EL++ reasoner's first duty is to find contradictions before they spread. The completion algorithm of el_completion.py does this with one dedicated inference, CR⊥, the bottom rule (el_completion.py lines 240–244):

        # CR⊥ (the bottom rule): (A, B) ∈ R(r), ⊥ ∈ S(B)  ⟹  ⊥ ∈ S(A)
        for r, pairs in list(R.items()):
            for (A, B) in list(pairs):
                if BOT in S[B] and BOT not in S[A]:
                    S[A].add(BOT); changed = True

Written as a completion rule, it propagates unsatisfiability backward along a role: if $A$ is related by $r$ to a $B$ that is itself impossible, then $A$ is impossible too.

$$(A, B) \in R(r) \ \wedge\ \bot \in S(B) \quad\Longrightarrow\quad \bot \in S(A).$$

Watch it fire on the academic world's deliberate trap. The TBox declares TenuredStudent ⊑ Professor and TenuredStudent ⊑ Student (ontology.py lines 158–159), together with the disjointness axiom Professor ⊓ Student ⊑ ⊥ (line 143). Completion puts both Professor and Student into $S(\text{TenuredStudent})$ by rule CR1, then rule CR2 fires the disjointness axiom to add $\bot$ — TenuredStudent can never have an instance. Now the second trap springs: TenuredStudentAdvisor ⊑ ∃advises.TenuredStudent (line 163) puts the pair (TenuredStudentAdvisor, TenuredStudent) into $R(\text{advises})$, and because $\bot \in S(\text{TenuredStudent})$, the bottom rule propagates $\bot$ one hop back to TenuredStudentAdvisor. The reasoner reports exactly two casualties — this is the real, committed output of python3 el_completion.py:

unsatisfiable concepts (2): ['TenuredStudent', 'TenuredStudentAdvisor']

That set is read straight off the saturated data by the unsatisfiable function, which collects every named concept whose subsumer set contains $\bot$ (el_completion.py lines 273–276):

def unsatisfiable(S) -> set:
    """The named concepts found to be unsatisfiable (A ⊑ ⊥)."""
    return {a for a, subs in S.items()
            if BOT in subs and a not in (TOP, BOT) and not is_fresh(a)}

Here is the crucial containment. These two concepts are unsatisfiable — a schema-level defect, a class that can never have a member — but the knowledge base as a whole is still consistent, because the ABox asserts no individual to be a TenuredStudent or a TenuredStudentAdvisor. The bottom rule caught the modeling bug at classification time, quarantined to two named concepts, long before any data assertion could push a concrete individual into $\bot$ and detonate explosion across the entire base. That is the difference between a defect the reasoner flags for you and a catastrophe it lets you avoid — the same "you modelled a class two incompatible ways" bug an ontology engineer wants to hear about at design time, not in production.

The chase that never stops

Explosion is a way a reasoner gives a wrong answer. Non-termination is a way it gives no answer — it simply never stops. Under OWA, existential axioms assert that something exists without naming it, and the chase satisfies them by inventing fresh anonymous individuals called nulls. When those invented individuals themselves trigger the axiom that made them, the chase can run forever. The companion's chase.py includes exactly such a rule (chase.py lines 204–208):

NONTERMINATING_INSTANCE = {("Researcher", "alice")}
NONTERMINATING_TGDS = [
    ([("Researcher", "?x")],
     [("advises", "?y", "?x"), ("Researcher", "?y")]),
]

The rule reads "every researcher was advised by some researcher." Alice is a researcher, so the chase mints an advisor _n1 who is also a researcher — who therefore needs an advisor _n2, also a researcher, and so on without end, an infinite regress of ever-more-senior phantom advisors. Termination of the chase is undecidable in general (chase.py lines 28–30): no algorithm can inspect an arbitrary rule set and always decide whether its chase halts. The only defense the code has is a pragmatic circuit breaker, the max_steps cap, and the real run makes the divergence visible but bounded — this is the committed output of python3 chase.py:

Non-terminating TGD (Researcher(x) -> ∃y advises(y,x) ∧ Researcher(y))
  terminated=False after the 50-firing cap; 50 fresh advisors invented and still growing

terminated=False is the honest confession: the reasoner did not finish, it was stopped. A step cap keeps the process alive but answers nothing — cut it at 50 and you have 50 phantom advisors, cut it at a million and you have a million. This is not a bug to be patched; it is the reason the chapter on the EL family and its polynomial guarantees mattered. The tractable fragments exist precisely so the chase is provably finite and questions like these have answers at all.

Repair: certain answers over every maximal consistent subset

Suppose the worst has already happened: a knowledge base is inconsistent, perhaps because an information-extraction pipeline read a noisy source and asserted something false. Classical logic would throw the whole base away — everything follows, so nothing is trustworthy. Inconsistency-tolerant semantics refuses that surrender and asks a sharper question: which answers survive no matter which consistent story we believe [2]?

The key construct is a repair: a maximal subset of the ABox that is consistent with the TBox. "Maximal" means you throw away as little as possible — remove just enough assertions to restore consistency, and no more. A single inconsistent base can have several repairs, one for each minimal way of resolving the clash. Under the AR (ABox Repair) semantics, a tuple is a certain answer to a query only if it is an answer over every repair — the intersection of what all the repaired stories agree on [3]:

$$\mathrm{cert}_{\mathrm{AR}}\big(q, \langle \mathcal{T}, \mathcal{A}\rangle\big) \;=\; \bigcap_{\mathcal{A}' \in \mathrm{Rep}(\mathcal{T}, \mathcal{A})} \mathrm{cert}\big(q, \langle \mathcal{T}, \mathcal{A}'\rangle\big).$$

Ground it in the academic world. The ABox asserts Student(carol). Imagine an extractor also, wrongly, asserts Professor(carol). Now the disjointness axiom Professor ⊓ Student ⊑ ⊥ forces carol into $\bot$: the base is inconsistent and, classically, explodes. But it has exactly two repairs — drop one clashing assertion or the other — and a query answered over both can still be trusted:

repair (maximal consistent subset)	dropped assertion	Student(carol)?	Researcher(carol)?
$\mathcal{A}_1$ keeps Student(carol)	Professor(carol)	yes	yes
$\mathcal{A}_2$ keeps Professor(carol)	Student(carol)	no	yes
certain answer (intersection)	—	unknown	yes

Student(carol) holds in only one repair, so it is not a certain answer — the base cannot vouch for it. But Researcher(carol) holds in both, because Professor ⊑ Researcher and Student ⊑ Researcher route to Researcher either way: whichever clashing fact is true, carol is a researcher. Grounded in the full academic world she is certain even more robustly — the ABox also asserts advises(carol, erin), so axiom (5) ∃advises.⊤ ⊑ Researcher already entails Researcher(carol) by a route the Professor/Student clash never touches. So even over a base that classically proves everything, AR semantics still returns exactly the answers a human would trust and abstains on the ones genuinely in doubt. It is the intersection-over-models idea we already met in the chase's certain_answers — where an answer counts only if it uses no invented null (chase.py lines 160–170) — transported from incomplete knowledge to inconsistent knowledge: both keep only what is true across every admissible world.

Graded trust: preferring the facts you believe

Treating every repair as equally credible is the cautious default, but annotations let a reasoner do better. If the facts carry the confidence labels of the previous part — the CONFIDENCE = Semiring(0.0, 1.0, max, min, ...) of annotated.py line 132, truth degrees drawn from the interval $[0,1]$ — then not all repairs are equally plausible. Suppose the curated Student(carol) carries confidence 0.9 and the freshly extracted Professor(carol) only 0.4. A preferred repair keeps the higher-trust assertion and drops the doubtful one, selecting $\mathcal{A}_1$ over $\mathcal{A}_2$ instead of hedging across both. The abstract machinery is unchanged — repairs are still maximal consistent subsets — but the confidence lattice supplies an ordering that says which repair to believe when they disagree.

This pairing is a pattern the rest of the series returns to: abstain honestly where the symbols are silent, and let graded trust break ties where the symbols clash. A learned model over noisy text produces facts with scores, not certainties; the symbolic layer keeps those scores from exploding a base by containing contradictions into repairs, and uses the scores themselves to prefer the repair worth believing. Volume 5 builds directly on this — a neuro-symbolic system where the neural half emits confidences and the symbolic half enforces consistency is exactly abstention-plus-graded-trust wearing an engineering hat.

Three honest responses to imperfect knowledge: abstaining with unknown when the base is silent, containing a contradiction with the bottom rule so it cannot explode across the base, and repairing an inconsistent ABox into maximal consistent subsets whose shared answers stay trustworthy. Original diagram by the authors, created with AI assistance.

The unsolved part

The machinery of this chapter detects silence and contradiction with mathematical precision — OWA tells you exactly when to abstain, the bottom rule tells you exactly which concepts are impossible, AR semantics tells you exactly which answers survive. What none of it settles is what a system should do about either, because that decision is not a logical fact but an application choice. When a base is silent, should the reasoner abstain, or fall back on a learned guess, or ask a human — and at what cost of a wrong default? When a base is inconsistent, which repair is right? AR semantics deliberately refuses to choose, returning only the common core; but a real system often must act on a single answer, and the "least surprising" repair, the "highest-confidence" repair, and the "smallest-change" repair can be three different sets of facts with no principled tiebreak among them. Worse, computing certain answers under repair semantics is often computationally harder than ordinary query answering, so the honest option is sometimes the expensive one. Deciding what to do with missing or contradictory knowledge is genuinely open, application-specific, and exactly the seam where a symbolic reasoner's guarantees run out and a learned component's judgment must take over.

Why it matters

Everything the neuro-symbolic program tries to build sits downstream of this chapter's two constraints. A learned extractor reading the open web produces knowledge that is both incomplete and internally contradictory — the two failure modes at once. A hybrid system that let the symbolic layer convert every gap into a confident "no" would hallucinate denials; one that let a single extracted contradiction reach a classical reasoner would watch the whole base explode into proving anything. The disciplines here are what make the symbolic half safe to couple to a noisy neural half: abstain where nothing is entailed, contain contradictions so one bad fact does not poison the rest, and repair to a consistent core whose answers you can still trust, using confidence to prefer what you believe. That is precisely the interface a robust neuro-symbolic system needs — a reasoner that knows the difference between "no" and "I do not know," and does not collapse the first time its inputs disagree.

Key terms

• Open-world assumption (OWA) — the DL/OWL default: an unstated, unentailed fact is unknown, not false; a claim is true only if it holds in every model.
• Closed-world assumption (CWA) — the Datalog/database default: an unstated, non-derivable fact is false; its operational counterpart in logic programming is negation-as-failure, the two coinciding for definite and stratified programs.
• Abstention — the honest OWA reply unknown to a query that is neither entailed nor refuted, e.g. Dean(alice).
• Principle of explosion (ex falso quodlibet) — classically, a contradiction entails every sentence, $\bot \models \psi$; one clash makes a base useless.
• Unsatisfiable concept — a concept with $\bot$ in its subsumers ($A \sqsubseteq \bot$), which can never have an instance; the academic world has two, TenuredStudent and TenuredStudentAdvisor.
• Bottom rule (CR⊥) — the completion rule propagating $\bot$ backward along a role, flagging unsatisfiable concepts before an ABox assertion can detonate the whole base.
• The chase / non-termination — satisfying existential axioms by inventing nulls; termination is undecidable, and the max_steps cap is a guard, not a solution.
• Repair — a maximal subset of the ABox consistent with the TBox; a clashing base has one repair per minimal way to resolve the clash.
• AR (ABox Repair) semantics / certain answer — a tuple is certain only if it is an answer over every repair — the intersection across repaired stories.
• Preferred repair — a repair chosen by confidence or trust rather than treated as one of many equals; where graded annotation breaks the tie.

Where this leads

Twenty-one chapters in, the shape of the symbolic pillar is complete: ontologies and description logic to say things precisely, completion and the chase to derive their consequences, complexity results to know what is tractable, annotations and time to attach how sure and when, and now the discipline to stay honest when knowledge is missing or contradictory. The closing chapter, The Honest Verdict, takes inventory of exactly this: what symbolic reasoning genuinely guarantees — soundness, decidability in the right fragments, an auditable "unknown" and a contained contradiction — and, just as sharply, what it does not, which is the precise gap a learned component is meant to fill. It is where this volume's answers, and its open questions, are weighed together.