gdp-wired 0.1.0 → 0.3.0

package/dist/kernel/prove.js

@@ -1,5 +1,5 @@
 import { add, k, scale, solve, sub } from "../core/solver.js";
-import { canon, checkLaws, checkStepLaws, historyMachine, leafConstraints, linear, obligations, stepLawObligations, truth, unreachable, withProducts } from "./kernel.js";
+import { canon, check, checkLaws, checkStepLaws, historyMachine, leafConstraints, linear, livenessHelpful, livenessParts, obligations, plainKey, progressObligations, stepLawObligations, trueC, truth, unreachable, withProducts } from "./kernel.js";
 // The atoms the path leaves open, in evaluation order: deciding any of them makes progress.
 function openE(e, path, out) {
     switch (e.op) {
@@ -32,7 +32,7 @@ function openE(e, path, out) {
 function openC(c, path, out) {
     if (truth(c, path) !== undefined)
         return;
-    if (c.op === 'flag')
+    if (c.op === 'flag' || c.op === 'all')
         return;
     if (c.op === 'not')
         return openC(c.x, path, out);
@@ -68,7 +68,7 @@ function openH(c, path, out, positive = true) {
             openC(c, path, out);
         return;
     }
-    if (c.op === 'flag')
+    if (c.op === 'flag' || c.op === 'all')
         return;
     const before = out.length;
     openE(c.a, path, out), openE(c.b, path, out);
@@ -113,8 +113,9 @@ function parse(text) {
     }
     return out;
 }
-// The budget: 200,000 nodes and, by default, 20 seconds per goal; past either the goal is left `unknown`.
-export function grow(goal, path = new Map(), budget = { nodes: 0, until: performance.now() + 20_000 }) {
+// The budget: 200,000 nodes and, by default, a second per hypothesis (at least 20 seconds) per goal; past either the goal
+// is left `unknown`. A goal with many instances (a law about two keys at its pairs) has that many more rows per leaf.
+export function grow(goal, path = new Map(), budget = { nodes: 0, until: performance.now() + Math.max(20_000, 1_000 * goal.hyps.length) }) {
     if (++budget.nodes > 200_000 || (budget.until !== undefined && performance.now() > budget.until))
         return { stuck: 'unknown', path };
     const rows = leafConstraints(goal, path);
@@ -223,11 +224,17 @@ function fractional(point, path) {
     return undefined;
 }
 // The keys a proof assumes the every-key laws at: every key the step and the laws read, and the fresh key of the goal.
+// A key bound by a quantified flag or a write at every key isn't one: those reads are at every key already.
 function readKeys(m, laws) {
     const out = new Map();
+    const bound = new Set([...Object.values(m.step.flags ?? {}).flatMap(c => (c.op === 'all' ? [c.key] : [])), ...Object.values(m.step.maps ?? {}).flatMap(w => ('each' in w ? [w.each] : []))]);
+    const free = (e) => !JSON.stringify(e).match(/"name":"([^"]+)"/g)?.some(n => bound.has(n.slice(8, -1)));
     const inE = (e) => {
-        if (e.op === 'get')
-            (out.set(JSON.stringify(e.key), e.key), inE(e.key));
+        if (e.op === 'get') {
+            if (free(e.key))
+                out.set(JSON.stringify(e.key), e.key);
+            inE(e.key);
+        }
         else if (e.op === 'if')
             (inC(e.c), inE(e.then), inE(e.else));
         else if (e.op === 'mul')
@@ -235,20 +242,208 @@ function readKeys(m, laws) {
         else if ('a' in e)
             (inE(e.a), inE(e.b));
     };
-    const inC = (c) => (c.op === 'flag' ? undefined : c.op === 'not' ? inC(c.x) : c.op === 'and' || c.op === 'or' ? c.xs.forEach(inC) : (inE(c.a), inE(c.b)));
+    const inC = (c) => (c.op === 'flag' ? undefined : c.op === 'all' ? inC(c.c) : c.op === 'not' ? inC(c.x) : c.op === 'and' || c.op === 'or' ? c.xs.forEach(inC) : (inE(c.a), inE(c.b)));
     Object.values(m.step.state ?? {}).forEach(inE);
     Object.values(m.step.flags ?? {}).forEach(inC);
-    for (const w of Object.values(m.step.maps ?? {}))
-        (out.set(JSON.stringify(w.key), w.key), inE(w.key), inE(w.value));
+    for (const w of Object.values(m.step.maps ?? {})) {
+        if (!('each' in w)) {
+            out.set(JSON.stringify(w.key), w.key);
+            inE(w.key);
+        }
+        inE(w.value);
+    }
     for (const l of laws.filter(l => !l.forall))
         inC(l.holds);
     return [...out.values()];
 }
+const shifts = (m) => Object.values(m.step.maps ?? {}).some(w => 'each' in w && !plainKey(w.value, w.each));
+// The keys some goals read a map at.
+function mapKeys(goals) {
+    const out = new Map();
+    const inE = (e) => {
+        if (e.op === 'get') {
+            out.set(JSON.stringify(e.key), e.key);
+            inE(e.key);
+        }
+        else if (e.op === 'if')
+            (inC(e.c), inE(e.then), inE(e.else));
+        else if (e.op === 'mul')
+            inE(e.a);
+        else if ('a' in e)
+            (inE(e.a), inE(e.b));
+    };
+    const inC = (c) => (c.op === 'flag' ? undefined : c.op === 'all' ? inC(c.c) : c.op === 'not' ? inC(c.x) : c.op === 'and' || c.op === 'or' ? c.xs.forEach(inC) : (inE(c.a), inE(c.b)));
+    for (const g of goals)
+        g.hyps.forEach(inC);
+    return [...out.values()];
+}
+// Instances with each every-key law also at these keys. A law about two keys or more goes at tuples that relate the
+// goal's own keys (`focus`: the skolems of the law it proves, or a step law's keys) to each other and to the keys that
+// read none of them: at the i-th place, a key that reads the i-th focus alone (the first, past the focus there is), and
+// at most one place a key that reads no focus.
+const withReads = (laws, inst, keys, focus) => ({ ...inst, ...Object.fromEntries(laws.filter(l => l.forall).map(l => {
+        const had = inst[l.name] ?? [];
+        if (l.keys?.length) {
+            const n = l.keys.length + 1;
+            const reads = (e, x) => x !== undefined && JSON.stringify(e).includes(`"name":${JSON.stringify(x)}`);
+            const own = (i) => { const f = focus[i] ?? focus[0]; return keys.filter(e => reads(e, f) && focus.every(g => g === f || !reads(e, g))); };
+            const R = keys.filter(e => !focus.some(f => reads(e, f)));
+            const out = new Map();
+            for (let i = 0; i + n <= had.length; i += n)
+                out.set(JSON.stringify(had.slice(i, i + n)), had.slice(i, i + n));
+            const go = (i, tuple, rest) => {
+                if (i === n) {
+                    out.set(JSON.stringify(tuple), tuple);
+                    return;
+                }
+                for (const e of own(i))
+                    go(i + 1, [...tuple, e], rest);
+                if (!rest)
+                    for (const e of R)
+                        go(i + 1, [...tuple, e], true);
+            };
+            go(0, [], false);
+            return [l.name, [...out.values()].flat()];
+        }
+        const seen = new Set(had.map(e => JSON.stringify(e)));
+        return [l.name, [...had, ...keys.filter(e => { const id = JSON.stringify(e); return seen.has(id) ? false : (seen.add(id), true); })]];
+    })) });
+// A law about every n keys at every n-tuple of the keys (flattened, as Instances keeps tuples).
+const tuples = (keys, n) => (n === 0 ? [] : n === 1 ? keys : keys.flatMap(a => { const rest = tuples(keys, n - 1); return Array.from({ length: rest.length / (n - 1) }, (_, t) => [a, ...rest.slice(t * (n - 1), (t + 1) * (n - 1))]).flat(); }));
+// The keys some goals read a function at.
+function fnKeys(m, goals) {
+    const fns = Object.keys(m.fns ?? {}), out = new Map();
+    const inE = (e) => {
+        if (e.op === 'get') {
+            if (fns.includes(e.map))
+                out.set(JSON.stringify(e.key), e.key);
+            inE(e.key);
+        }
+        else if (e.op === 'if')
+            (inC(e.c), inE(e.then), inE(e.else));
+        else if (e.op === 'mul')
+            inE(e.a);
+        else if ('a' in e)
+            (inE(e.a), inE(e.b));
+    };
+    const inC = (c) => (c.op === 'flag' ? undefined : c.op === 'all' ? inC(c.c) : c.op === 'not' ? inC(c.x) : c.op === 'and' || c.op === 'or' ? c.xs.forEach(inC) : (inE(c.a), inE(c.b)));
+    for (const g of goals)
+        g.hyps.forEach(inC);
+    return [...out.values()];
+}
+// Instances with each fact about every key assumed where it reads a function at one of these keys: its key at each
+// value that makes one of its reads one of these (by matching: a function of several arguments reads a paired key), and
+// at the keys themselves.
+const withFacts = (m, inst, keys) => ({ ...inst, ...Object.fromEntries((m.facts ?? []).filter(f => f.forall).map(f => {
+        if (f.keys?.length)
+            return [f.name, tuples(keys, f.keys.length + 1)];
+        const had = inst[f.name] ?? [], seen = new Set(had.map(e => JSON.stringify(e)));
+        const reads = fnKeys(m, [{ name: '', hyps: [f.holds] }]);
+        const at = [...keys, ...reads.flatMap(pattern => keys.flatMap(key => { const b = match(pattern, key, f.forall); return b ? [b] : []; }))];
+        return [f.name, [...had, ...at.filter(e => { const id = JSON.stringify(e); return seen.has(id) ? false : (seen.add(id), true); })]];
+    })) });
+// The value of x that makes pattern the term, if one does (structurally).
+function match(pattern, term, x) {
+    let bound;
+    const go = (p, t) => {
+        if (p.op === 'var' && p.name === x) {
+            if (bound)
+                return JSON.stringify(bound) === JSON.stringify(t);
+            bound = t;
+            return true;
+        }
+        if (p.op !== t.op)
+            return false;
+        const pe = Object.entries(p), te = t;
+        return pe.every(([k, v]) => k === 'op' || (typeof v === 'object' && v !== null ? (Array.isArray(v) ? Array.isArray(te[k]) && te[k].length === v.length && v.every((y, i) => go(y, te[k][i])) : go(v, te[k])) : v === te[k]));
+    };
+    return go(pattern, term) ? bound : undefined;
+}
+// Each quantified flag's witness w?f: a key where its condition fails, when it does; every-key facts are wanted there too.
+const witnesses = (m) => Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => (c.op === 'all' ? [{ op: 'var', name: `w?${f}` }] : []));
+// The keys each quantified flag is assumed at (instances under ?f).
+const flagInstances = (m, keys) => Object.fromEntries(Object.entries(m.step.flags ?? {}).flatMap(([f, c]) => (c.op === 'all' ? [[`?${f}`, keys]] : [])));
+const someKeys = (c, positive = true) => c.op === 'all' ? [...(positive ? [] : [c]), ...someKeys(c.c, positive)] : c.op === 'not' ? someKeys(c.x, !positive) : c.op === 'and' || c.op === 'or' ? c.xs.flatMap(y => someKeys(y, positive)) : [];
+function atWitness(c, picks, positive = true) {
+    switch (c.op) {
+        case 'all': return !positive && picks[c.key] ? atWitness(substVar(c.c, c.key, picks[c.key]), picks, positive) : { ...c, c: atWitness(c.c, picks, positive) };
+        case 'not': return { op: 'not', x: atWitness(c.x, picks, !positive) };
+        case 'and':
+        case 'or': return { op: c.op, xs: c.xs.map(y => atWitness(y, picks, positive)) };
+        case 'flag':
+        case '<':
+        case '<=':
+        case '=': return c;
+    }
+}
+function substVar(c, name, by) {
+    const e = (t) => {
+        switch (t.op) {
+            case 'var': return t.name === name ? by : t;
+            case 'const': return t;
+            case 'mul': return { ...t, a: e(t.a) };
+            case 'if': return { op: 'if', c: substVar(t.c, name, by), then: e(t.then), else: e(t.else) };
+            case 'get': return { ...t, key: e(t.key) };
+            case 'add':
+            case 'sub':
+            case 'min':
+            case 'max':
+            case 'prod': return { ...t, a: e(t.a), b: e(t.b) };
+        }
+    };
+    return c.op === 'flag' ? c : c.op === 'all' ? { ...c, c: substVar(c.c, name, by) } : c.op === 'not' ? { op: 'not', x: substVar(c.x, name, by) } : c.op === 'and' || c.op === 'or' ? { op: c.op, xs: c.xs.map(y => substVar(y, name, by)) } : { ...c, a: e(c.a), b: e(c.b) };
+}
+const candidates = (m, names) => {
+    const vars = [...new Set([...names, ...m.params, ...Object.keys(m.state)])];
+    return [{ op: 'const', value: 0 }, ...vars.map((name) => ({ op: 'var', name })), ...Object.keys(m.maps ?? {}).flatMap(map => vars.map((name) => ({ op: 'get', map, key: { op: 'var', name } })))];
+};
+// Witnesses for every some-key in `items`, chosen in order: each the first candidate under which `proves` accepts the
+// items whose some-keys are all named so far. Undefined, with the some-key's law, if none does.
+function chooseWitnesses(items, body, names, m, proves, rebuild) {
+    const picks = {};
+    for (const t of items)
+        for (const q of someKeys(body(t)))
+            if (q.witness)
+                picks[q.key] = q.witness;
+    const resolved = (all) => items.filter(t => all || someKeys(body(t)).every(q => q.key in picks)).map(t => (someKeys(body(t)).length ? rebuild(t, atWitness(body(t), picks)) : t));
+    for (const t of items)
+        for (const q of someKeys(body(t))) {
+            if (q.key in picks)
+                continue;
+            const found = candidates(m, names(t)).find(w => { picks[q.key] = w; return proves(resolved(false)); });
+            if (!found) {
+                delete picks[q.key];
+                return { stuck: `no witness found for some key in ${t.name}: name one (someKey(f, witness))` };
+            }
+        }
+    return { items: resolved(true) };
+}
 export function proveLaws(m, laws) {
-    const keys = readKeys(m, laws);
+    if (!laws.some(l => someKeys(l.holds).length))
+        return proveLawsAsGiven(m, laws);
+    const out = chooseWitnesses(laws, l => l.holds, l => (l.forall ? [l.forall] : []), m, ls => { const r = proveLawsAsGiven(m, ls); return r.proven && r.checked; }, (l, holds) => ({ ...l, holds, stated: l.stated ?? l.holds }));
+    if ('stuck' in out)
+        return { proven: false, nodes: 0, leaves: 0, failed: { goal: 'witnesses', stuck: out.stuck }, checked: false };
+    return { ...proveLawsAsGiven(m, out.items), laws: out.items };
+}
+function proveLawsAsGiven(m, laws) {
+    const keys = [...readKeys(m, laws), ...witnesses(m)];
     const instances = {};
-    for (const law of laws)
-        instances[law.name] = Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, [...keys, ...(law.forall ? [{ op: 'var', name: `${law.forall}#` }] : [])]]));
+    for (const law of laws) {
+        const at = [...keys, ...(law.forall ? [{ op: 'var', name: `${law.forall}#` }] : []), ...(law.keys ?? []).map((name) => ({ op: 'var', name }))];
+        instances[law.name] = { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : at])), ...flagInstances(m, at) };
+    }
+    // The facts about functions, at every key each law's goals read a function at (found from the goals, twice round).
+    for (let round = 0; round < 2 && m.facts?.length; round++) {
+        const goals = obligations(m, laws, instances);
+        laws.forEach((law, i) => { instances[law.name] = withFacts(m, instances[law.name], fnKeys(m, goals.slice(2 * i, 2 * i + 2))); });
+    }
+    // Where positions shift (a write at every key reading its key at k ∸ 1 or k + 1) or a law is about two keys, the
+    // every-key laws also at each key the goals read a map at, once round.
+    if (shifts(m) || laws.some(l => l.keys?.length)) {
+        const goals = obligations(m, laws, instances);
+        laws.forEach((law, i) => { instances[law.name] = withReads(laws, instances[law.name], mapKeys(goals.slice(2 * i, 2 * i + 2)), [...(law.forall ? [`${law.forall}#`] : []), ...(law.keys ?? [])]); });
+    }
     const trees = {};
     let nodes = 0, leaves = 0;
     for (const goal of obligations(m, laws, instances)) {
@@ -262,19 +457,39 @@ export function proveLaws(m, laws) {
     const proof = { instances, trees };
     return { proven: true, nodes, leaves, checked: checkLaws(m, laws, proof), proof };
 }
-// Step laws (kernel.ts's stepLawObligations): the laws proven first (they are assumed), then one goal per step law, the
-// every-key laws assumed at every key the step, the laws and the step laws read.
-export function proveStepLaws(m, laws, stepLaws) {
-    const base = proveLaws(m, laws);
+export function proveStepLaws(m, given, stepLaws) {
+    const base = proveLaws(m, given);
     if (!base.proven || !base.proof)
         return { proven: false, nodes: base.nodes, leaves: base.leaves, ...(base.failed ? { failed: base.failed } : {}), checked: false };
+    const laws = base.laws ?? given;
+    if (stepLaws.some(sl => someKeys(sl.then).length)) {
+        // Each step law's witnesses on its own (a step law assumes no other), the request and the state after among them.
+        const plain = m.history ? historyMachine(m).machine : m, after = Object.keys(plain.state).map(n => `${n}'`);
+        const out = chooseWitnesses(stepLaws, sl => sl.then, sl => [...(sl.forall ? [sl.forall] : []), ...plain.inputs, ...after], plain, sls => sls.every(sl => { const r = proveStepLawsAsGiven(m, laws, [sl], base); return r.proven && r.checked; }), (sl, then) => ({ ...sl, then }));
+        if ('stuck' in out)
+            return { proven: false, nodes: base.nodes, leaves: base.leaves, failed: { goal: 'witnesses', stuck: out.stuck }, checked: false };
+        return { ...proveStepLawsAsGiven(m, laws, out.items, base), ...(base.laws ? { laws } : {}), stepLaws: out.items };
+    }
+    return { ...proveStepLawsAsGiven(m, laws, stepLaws, base), ...(base.laws ? { laws } : {}) };
+}
+function proveStepLawsAsGiven(m, laws, stepLaws, base) {
+    if (!base.proof)
+        return { proven: false, nodes: base.nodes, leaves: base.leaves, checked: false };
     const plain = m.history ? historyMachine(m).machine : m;
-    const keys = [...readKeys(plain, laws), ...stepLaws.flatMap(sl => [...readKeysC(sl.then), ...(sl.when ? readKeysC(sl.when) : [])])];
-    const instances = Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, keys]));
+    const keys = [...readKeys(plain, laws), ...witnesses(plain), ...stepLaws.flatMap(sl => [sl.then, ...(sl.when === undefined ? [] : Array.isArray(sl.when) ? sl.when : [sl.when])].flatMap(readKeysC)),
+        ...stepLaws.flatMap(sl => [sl.forall, ...(sl.keys ?? [])].flatMap(key => (key ? [{ op: 'var', name: key }] : [])))];
+    let instances = { ...Object.fromEntries(laws.filter(l => l.forall).map(l => [l.name, l.keys?.length ? [] : keys])), ...flagInstances(plain, keys) };
+    for (let round = 0; round < 2 && plain.facts?.length; round++)
+        instances = withFacts(plain, instances, fnKeys(plain, stepLaws.flatMap(sl => stepLawObligations(m, laws, instances, sl))));
+    // Where positions shift or a law is about two keys, each step law gets its own instances, from its own goal.
+    const perStep = {};
+    if (shifts(plain) || laws.some(l => l.keys?.length))
+        for (const sl of stepLaws)
+            perStep[sl.name] = withReads(laws, instances, mapKeys(stepLawObligations(m, laws, instances, sl)), [sl.forall, ...(sl.keys ?? [])].flatMap(k => (k ? [k] : [])));
     const trees = {};
     let nodes = base.nodes, leaves = base.leaves;
     for (const sl of stepLaws)
-        for (const goal of stepLawObligations(m, laws, instances, sl)) {
+        for (const goal of stepLawObligations(m, laws, perStep[sl.name] ?? instances, sl)) {
             const out = grow(goal);
             if (!('tree' in out))
                 return { proven: false, nodes, leaves, failed: { goal: goal.name, stuck: out.stuck, ...(out.witness ? { witness: out.witness } : {}) }, checked: false };
@@ -282,9 +497,53 @@ export function proveStepLaws(m, laws, stepLaws) {
             nodes += out.nodes;
             leaves += countLeaves(out.tree);
         }
-    const proof = { laws: base.proof, instances, trees };
+    const proof = { laws: base.proof, instances, ...(Object.keys(perStep).length ? { perStep } : {}), trees };
     return { proven: true, nodes, leaves, checked: checkStepLaws(m, laws, stepLaws, proof), proof };
 }
+// Progress (kernel.ts's progressObligations): the laws proven first, then each goal, the every-key laws assumed at every
+// key the goals read a map at.
+export function proveProgress(m, laws, p) {
+    const base = proveLaws(m, laws);
+    if (!base.proven || !base.checked)
+        return { proven: false, nodes: base.nodes, leaves: base.leaves, ...(base.failed ? { failed: base.failed } : {}), checked: false };
+    const ls = base.laws ?? laws;
+    let instances = { ...withReads(ls, {}, mapKeys(progressObligations(m, ls, {}, p)), []), ...flagInstances(m, mapKeys(progressObligations(m, ls, {}, p))) };
+    instances = { ...instances, ...withReads(ls, instances, mapKeys(progressObligations(m, ls, instances, p)), []) };
+    if (m.facts?.length)
+        instances = withFacts(m, instances, fnKeys(m, progressObligations(m, ls, instances, p)));
+    const trees = {};
+    let nodes = base.nodes, leaves = base.leaves;
+    for (const goal of progressObligations(m, ls, instances, p)) {
+        const out = grow(goal);
+        if (!('tree' in out))
+            return { proven: false, nodes, leaves, failed: { goal: goal.name, stuck: out.stuck, ...(out.witness ? { witness: out.witness } : {}) }, checked: false };
+        trees[goal.name] = out.tree;
+        nodes += out.nodes;
+        leaves += countLeaves(out.tree);
+    }
+    return { proven: true, nodes, leaves, checked: progressObligations(m, ls, instances, p).every(g => check(g, trees[g.name])), instances, trees };
+}
+// Liveness (kernel.ts's livenessParts): its step laws, proven together. The claim needs no more (a run takes the
+// request, so it is allowed); but a request never allowed would leave the claim about no run, so where a helpful request
+// names every input a client sends and carries no maps, it is proven allowed in its region too.
+export function proveLiveness(m, laws, l) {
+    const { stay, cover, helps } = livenessParts(m, l);
+    const a = proveStepLaws(m, laws, [stay, cover, ...helps]);
+    if (!a.proven || !a.checked)
+        return { proven: false, nodes: a.nodes, leaves: a.leaves, ...(a.failed ? { failed: a.failed } : {}), checked: false };
+    const plain = m.history ? historyMachine(m).machine : m;
+    let nodes = a.nodes, leaves = a.leaves;
+    for (const [i, h] of livenessHelpful(l).entries()) {
+        if (m.history || plain.inputMaps?.length || !plain.assume || !plain.inputs.every(inp => inp in h.request))
+            continue;
+        const b = proveProgress(plain, laws, { name: `${l.name}: helpful request ${i + 1} is allowed`, when: { op: 'and', xs: [l.from, { op: 'not', x: l.to }, h.when] }, then: trueC, request: h.request });
+        nodes += b.nodes;
+        leaves += b.leaves;
+        if (!b.proven || !b.checked)
+            return { proven: false, nodes, leaves, ...(b.failed ? { failed: b.failed } : {}), checked: false };
+    }
+    return { proven: true, checked: true, nodes, leaves, steps: a };
+}
 // The key terms a condition reads maps at; a primed map's key is a key of the map before the step too.
 function readKeysC(c) {
     const out = [];
@@ -296,7 +555,7 @@ function readKeysC(c) {
         inE(e.a);
     else if ('a' in e)
         (inE(e.a), inE(e.b)); };
-    const inC = (x) => (x.op === 'flag' ? undefined : x.op === 'not' ? inC(x.x) : x.op === 'and' || x.op === 'or' ? x.xs.forEach(inC) : (inE(x.a), inE(x.b)));
+    const inC = (x) => (x.op === 'flag' || x.op === 'all' ? undefined : x.op === 'not' ? inC(x.x) : x.op === 'and' || x.op === 'or' ? x.xs.forEach(inC) : (inE(x.a), inE(x.b)));
     inC(c);
     return out;
 }
@@ -315,7 +574,7 @@ export function concretize(goal, bound = 12) {
         (walkC(e.c), walkE(e.then), walkE(e.else));
     else if ('a' in e)
         (walkE(e.a), 'b' in e && walkE(e.b)); };
-    const walkC = (c) => (c.op === 'flag' ? undefined : c.op === 'not' ? walkC(c.x) : c.op === 'and' || c.op === 'or' ? c.xs.forEach(walkC) : (walkE(c.a), walkE(c.b)));
+    const walkC = (c) => (c.op === 'flag' ? undefined : c.op === 'all' ? void (reads = true) : c.op === 'not' ? walkC(c.x) : c.op === 'and' || c.op === 'or' ? c.xs.forEach(walkC) : (walkE(c.a), walkE(c.b)));
     goal.hyps.forEach(walkC);
     if (reads || names.size > 4)
         return undefined;
@@ -334,7 +593,7 @@ export function concretize(goal, bound = 12) {
         }
     };
     const holds = (c, env) => c.op === 'not' ? !holds(c.x, env) : c.op === 'and' ? c.xs.every(y => holds(y, env)) : c.op === 'or' ? c.xs.some(y => holds(y, env))
-        : c.op === 'flag' ? false : c.op === '<' ? ev(c.a, env) < ev(c.b, env) : c.op === '<=' ? ev(c.a, env) <= ev(c.b, env) : ev(c.a, env) === ev(c.b, env);
+        : c.op === 'flag' || c.op === 'all' ? false : c.op === '<' ? ev(c.a, env) < ev(c.b, env) : c.op === '<=' ? ev(c.a, env) <= ev(c.b, env) : ev(c.a, env) === ev(c.b, env);
     const vars = [...names];
     const total = (bound + 1) ** vars.length;
     for (let i = 0; i < total; i++) {
@@ -345,3 +604,18 @@ export function concretize(goal, bound = 12) {
     }
     return undefined;
 }
+// A goal built from its instances (an exporter's goal, shaped as its Lean twin builds it): the every-key laws, the
+// quantified flags and the facts assumed at every key it reads a map or function at, then a tree, checked.
+export function proveBuilt(m, laws, build) {
+    let instances = {};
+    for (let round = 0; round < 2; round++) {
+        const g = build(instances), keys = mapKeys([g]);
+        instances = { ...withReads(laws, instances, keys, []), ...flagInstances(m, keys) };
+        if (m.facts?.length)
+            instances = withFacts(m, instances, fnKeys(m, [build(instances)]));
+    }
+    const goal = build(instances), out = grow(goal);
+    if (!('tree' in out) || !check(goal, out.tree))
+        return { proven: false };
+    return { proven: true, instances, goal, tree: out.tree };
+}

package/dist/lean-kernel/emit.d.ts

@@ -0,0 +1,132 @@
+import type { C, E, Law, Machine } from '../core/machine.js';
+import { type Step } from '../core/solver.js';
+import { type Fold, type Goal, type Instances, type Liveness, type Loop, type Path, type StepLaw, type Tree } from '../kernel/kernel.js';
+import { leanLibrary } from './library.js';
+export { leanLibrary };
+export type Exported = {
+    name: string;
+    goal: Goal;
+    tree: Tree;
+};
+export declare const int: (v: number) => string;
+export declare const list: (xs: string[]) => string;
+export declare function leaves(t: Tree, path: Path, visit: (t: Tree & {
+    leaf: Step[];
+    products?: [number, number][];
+}, path: Path) => void): void;
+export declare function encode(ex: Exported, tamper?: boolean, dropStep?: boolean, globalVars?: string[], globalMaps?: string[]): {
+    tab: string;
+    hyps: string;
+    tree: string;
+    cols: string[];
+    c: (t: C) => string;
+    e: (t: E) => string;
+};
+export declare function goalToLean(ex: Exported, i: number, tamper?: boolean, dropStep?: boolean): string;
+export declare function machineToLean(id: string, m: Machine, laws: Law[], corollary?: string): string;
+export declare const TRUE = ".le (.const 0) (.const 0)";
+export declare const grown: (g: Goal) => Tree;
+export declare function loopToLean(id: string, l: Loop, laws: Law[], rank: E | E[], tamper?: {
+    what: string;
+    loop: Loop;
+}): string;
+export declare function foldToLean(id: string, f: Fold, laws: Law[], extra?: string): string;
+export declare function readable(id: string, laws: Law[], vars: string[], maps: string[], reach: {
+    binders: string;
+    hyp: string;
+    call: string;
+}): string;
+export type ProgressCase = {
+    id: string;
+    name: string;
+    when: C;
+    then: C;
+    request: Record<string, E>;
+    instances: Instances;
+    tamper?: {
+        what: string;
+        when: C;
+    };
+};
+export declare function mmachineToLean(id: string, m: Machine, laws: Law[], opts?: {
+    corollary?: string;
+    tamper?: {
+        what: string;
+        machine: Machine;
+    };
+    progress?: ProgressCase[];
+    free?: string[];
+    stepLaws?: StepLaw[];
+    liveness?: Liveness[];
+    ghosts?: string[];
+    after?: (ix: (name: string) => number) => string;
+    refined?: {
+        impl: Machine;
+        spec: Machine;
+        wit: Record<string, E>;
+        stutter: C;
+        specPre: number;
+    };
+}): string;
+export declare const hasSets: (m: Machine) => boolean;
+export declare function smachineToLean(id: string, m: Machine, laws: Law[], opts?: {
+    stepLaws?: StepLaw[];
+    liveness?: Liveness[];
+    tamper?: {
+        what: string;
+        machine: Machine;
+    };
+    simp?: string[];
+    free?: string[];
+    refined?: {
+        impl: Machine;
+        spec: Machine;
+        wit: Record<string, E>;
+        stutter: C;
+        specPre: number;
+    };
+}): string;
+export declare function hmachineToLean(id: string, pruned: Machine, laws: Law[], tampers?: {
+    what: string;
+    relations: {
+        when: C;
+        holds: C;
+    }[];
+    withRecordTrees: boolean;
+}[], corollary?: (ix: (name: string) => number) => string): string;
+export type LeanItem = {
+    id: string;
+    machine: Machine;
+    laws: Law[];
+    stepLaws?: StepLaw[];
+    liveness?: Liveness[];
+    ghosts?: string[];
+    lean?: {
+        defs?: string;
+        simp?: string[];
+        after?: (ix: (name: string) => number) => string;
+    };
+} | {
+    id: string;
+    refinement: {
+        impl: Machine;
+        spec: Machine;
+        relation: Law[];
+        witness: Record<string, E>;
+        stutter?: C;
+    };
+} | {
+    id: string;
+    loop: Loop;
+    rank: E | E[];
+    laws?: Law[];
+} | {
+    id: string;
+    goal: Goal;
+};
+export declare function toLean(items: LeanItem[], opts?: {
+    title?: string;
+}): string;
+export declare function leanProject(file: string, opts?: {
+    name?: string;
+}): Record<string, string>;