Structurally impossible, not statistically rare.
A hallucination is a model assertion with no grounding. The question is not whether models hallucinate (they do) but whether the system surrounding the model lets an ungrounded assertion become an output. In Limma the answer is no, and the reason is structural rather than a matter of better prompting or finer tuning.
Every claim is in exactly one of three states.
Categorical, not a confidence score. The state determines what the engine will do with the claim. Transition rules between states are mechanical and inspectable.
Read from a source.
With a citation to the exact page, table cell, paragraph, or span. The engine knows where the value came from and can re-display it on demand.
claim = value from source S, location L
Derived from other facts via a rule.
The engine records the rule, the input facts, and the input facts’ own chains. The value can be recomputed and compared to the stored value at any time.
claim = value rule: V = f(A, B)
Cannot be grounded.
The engine returns an explicit unknown rather than fabricating an answer. The refusal is the output, not a fallback. Downstream consumers act on the refusal, or they wait.
claim = REFUSED reason: not in source, not derivable
There is no fourth state.
There is no “the model said so” path. There is no “the answer looks reasonable” path. There is no fallback that returns a fabricated value when the engine cannot ground it. Hallucinations cannot exit because the gate has no fourth state to assign them.
What each system actually promises.
Retrieval-grounded generation and Limma both claim to ground outputs. The contracts are not the same. The difference is what each one permits.
“The model saw these passages.”
The model is given the right passages and asked to generate from them. The grounding contract is that the cited passages exist and the model attended to them. It is not that the answer is mechanically derivable from those passages. A model can be given the right passages and still produce a wrong number. RAG has no path to catch that.
“Every value is reachable from sources by a mechanical path.”
Every output value is either extracted with a citation or computed with a rule plus inputs. The engine can replay the path. The auditor can walk it. The two contracts produce different categories of guarantee. RAG can be wrong in ways that are invisible at delivery time. Limma’s wrongness is structural: the chain is intact and reproducible, or it is broken and the system says so.
Refusal is a feature, not a failure.
The strongest claim Limma makes is also the most operationally useful. When the engine refuses, downstream consumers know the answer is genuinely unknown, not a confident guess. Build agents that act on what is verified, queue what is uncertain, and never fire on fabrication.